CVE-2026-72949

EUVD-2026-73344
Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 67.3%
Affected Products (NVD)
VendorProductVersion
microsoftwindows_11_23h2
𝑥
< 10.0.22631.7582
microsoftwindows_11_24h2
𝑥
< 10.0.26100.9445
microsoftwindows_11_25h2
𝑥
< 10.0.26200.9445
microsoftwindows_11_26h1
𝑥
< 10.0.28000.2954
microsoftwindows_server_2022
𝑥
< 10.0.20348.5622
microsoftwindows_server_2025
𝑥
< 10.0.26100.33438
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 11
23H2 (arm64, x64)
KB5122880
24H2 (arm64, x64)
KB5124008
25H2 (arm64, x64)
KB5124008
26H1 (arm64, x64)
KB5124012
Windows Server 2022
Server Core
KB5122882
Standard
KB5122882
Windows Server 2025
Server Core
KB5122871
Standard
KB5122871
Common Weakness Enumeration
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72949