Windows DHCP Server CVE-2026-45634

Exploitation requires: (1) the Windows DHCP Server role must be installed and running on the target system - this is a non-default role not present on standard workstations or servers unless explicitly configured; (2) the attacker must have a valid low-privileged local or domain account with the ability to interact locally with the target host (AV:L/PR:L per CVSS vector). Exploitation is NOT possible remotely over the network based on the local attack vector (AV:L). What limits exploitation: the attack surface is restricted to the subset of Windows hosts explicitly running the DHCP Server service; no remote unauthenticated exploitation is possible; no elevated privileges are required but local access (interactive session or equivalent) is mandatory. The presence of Windows 10 and Windows 11 client editions in the affected version list is noted, though the DHCP Server role is rarely deployed on client OS builds - those entries likely reflect shared codebase coverage rather than common deployment scenarios.

The CVSS base score of 5.5 (Medium) accurately reflects constrained real-world impact. The attack vector is local (AV:L), attack complexity is low (AC:L), privileges required are low (PR:L), and there is no user interaction (UI:N). Scope is unchanged (S:U), and impact is limited to confidentiality (C:H/I:N/A:N), meaning there is no integrity or availability impact. No EPSS data was provided in the source intelligence; risk should be treated as moderate-low absent that signal. The CVE is not listed in the CISA KEV catalog, and no POC has been identified. The practical threat is further bounded by the DHCP Server role prerequisite - this role is not installed by default and is typically present only on dedicated network infrastructure servers. Taken together, this is not a critical-priority vulnerability for most organizations, but is a high-priority patch for any host explicitly serving the DHCP Server role, particularly given the C:H confidentiality rating which could expose sensitive server memory contents to a low-privileged local user.

A low-privileged domain or local account holder with interactive or remote desktop access to a Windows Server running the DHCP Server role crafts a malformed request or invokes a vulnerable code path in the DHCP service, triggering the out-of-bounds read. The leaked memory contents are returned to the attacker and could expose sensitive data such as session credentials, cryptographic material, or configuration secrets resident in the DHCP service process memory. No public exploit code has been identified at time of analysis, so exploitation currently requires independent vulnerability research to identify the precise triggering input.