Windows DHCP Server CVE-2026-50518

The target host must have the Windows DHCP Server role installed and enabled and be reachable by the attacker's crafted DHCP traffic - directly on the same subnet/broadcast domain or via a DHCP relay agent forwarding requests to it. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no privileges, and no user interaction are required against a default-configured DHCP server. The primary limiting factor is deployment scope: only servers actually running the DHCP Server role are vulnerable, and because DHCP is normally link-local, remote exploitation generally requires network adjacency or a relay path rather than arbitrary Internet reachability. Affected platforms are limited to Windows Server 2012 through 2025 (including Server Core) and the shared Windows 10 1607/1809 code base.

All available signals point to genuine high priority rather than an inflated high-CVSS-but-low-real-risk issue: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with High impact to confidentiality, integrity, and availability, meaning a remote, unauthenticated attacker needs no user interaction and low complexity to exploit. The target is an infrastructure service that must be reachable by clients on the LAN/subnet, so within a broadcast domain the attack surface is broad. Countervailing factors: no EPSS score was supplied, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is identified, so exploitation is currently theoretical and DHCP heap RCE is often non-trivial to weaponize reliably. Note a scope consideration - DHCP traffic is normally link-local, so 'network' exploitation in practice usually requires the attacker to be on the same subnet or path a relayed request to the server; verify network exposure against your segmentation.

An attacker with a foothold on the local network (or an adjacent segment able to reach the DHCP service directly or via a relay) sends a specially crafted DHCP request whose oversized or malformed fields overflow a heap buffer in the DHCP Server service, corrupting memory to hijack execution and run code in the service context. Because no authentication or user interaction is required (PR:N/UI:N/AC:L), a single crafted packet could compromise the server; no public POC is currently identified, so this remains a plausible but not yet demonstrated exploitation path.