Windows DHCP Server CVE-2026-48564

Exploitation requires the target Windows host to have the DHCP Server role installed and running and reachable over the network on the DHCP service, plus the CVSS PR:L authorization level - the attacker must already hold a low-privilege authorized position rather than being fully anonymous (the description explicitly says 'authorized attacker'). No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: hosts without the DHCP Server role are not affected, network segmentation that blocks reaching the DHCP service prevents the attack, and the required authorization/foothold reduces purely opportunistic exploitation. This is not an unauthenticated default-configuration flaw.

The signals point to a genuine high-priority patch for organizations running the DHCP Server role. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with total compromise of the host on success. The PR:L requirement means the attacker needs some authenticated/authorized foothold rather than pure anonymous access, which meaningfully limits opportunistic mass exploitation but not a foothold-then-pivot scenario. No EPSS score and no SSVC decision data were provided, so exploitation probability cannot be quantified from this input. The CVE is not listed in CISA KEV and no POC is referenced, so this is not confirmed actively exploited - but DHCP servers are high-value domain infrastructure often running with elevated context, so the potential blast radius is severe. Note the agreement between PR:L in the CVSS vector and the description's phrase 'authorized attacker': both indicate authentication/authorization is required, so treat this as an authenticated RCE, not a wormable unauthenticated flaw.

An attacker who has obtained a low-privilege authorized foothold on the network sends specially crafted DHCP messages to a Windows DHCP Server, overflowing a heap buffer during message parsing to overwrite heap control data and execute code in the service context. Given AV:N/AC:L, the attack is network-reachable and low-complexity, letting the attacker pivot from a modest foothold to full compromise of core network infrastructure. No public exploit code has been identified at time of analysis.