EUVD-2026-43793
GHSA-x462-6h9x-cxcg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable DHCP service (AV:N), low-complexity parsing overflow (AC:L), authorized attacker so PR:L, no interaction (UI:N), and code execution yields full C/I/A on the host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows DHCP Server role allows an authenticated network attacker (PR:L) to trigger a heap-based buffer overflow and run arbitrary code on the server. The flaw affects DHCP Server across Windows Server 2012 through Server 2025 (including Server Core installations) and carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Technical ContextAI
The affected component is the Windows DHCP Server service, which handles Dynamic Host Configuration Protocol messages (typically UDP 67/68) to lease IP addresses and distribute network configuration to clients. The root cause is classified as CWE-122 (Heap-based Buffer Overflow): the service allocates a buffer on the heap and writes past its bounds while parsing attacker-influenced DHCP message data, corrupting adjacent heap structures. Successful heap grooming and overflow can overwrite control data (function pointers, heap metadata), enabling arbitrary code execution in the context of the DHCP service. Per the CPE data, the impacted binaries ship with Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations), plus the Windows 10 1607/1809 codebases that share the server DHCP role components.
RemediationAI
Apply the Microsoft security update for CVE-2026-48564 as published in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48564 (Patch available per vendor advisory); install the cumulative update matching each affected Windows Server / Windows 10 build via Windows Update or WSUS. Where immediate patching is not possible, reduce exposure by restricting which hosts can reach the DHCP service - segment DHCP servers, apply firewall rules to limit UDP 67 traffic to trusted client subnets and relay agents, and tighten who holds the authenticated foothold implied by PR:L (audit DHCP administrators and adjacent service accounts); note that overly aggressive filtering of DHCP relay/broadcast traffic can break legitimate address leasing, so validate scope-by-scope. If the DHCP Server role is not required on a given host, remove it. Prioritize domain-joined and internet-adjacent DHCP servers first.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today