Windows DHCP Server CVE-2026-50683

Exploitation requires the target to be running the Windows DHCP Server role (only DHCP servers are affected, not DHCP clients), and the attacker must have a presence on an adjacent network - the same layer-2 broadcast/link-local segment as the server (AV:A), not routed internet access. The attacker must also already hold low-level privileges/authentication (PR:L), so this is a privilege-escalation primitive for an attacker with an existing foothold rather than a purely external unauthenticated attack. No user interaction is required (UI:N) and complexity is low (AC:L). Limiting factors that reduce real-world exposure: servers without the DHCP role are not vulnerable, network segmentation that isolates the DHCP server from untrusted hosts removes the adjacency prerequisite, and the attacker needs at least low privileges to begin.

The CVSS 3.1 base score is 8.0 (High) with vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The adjacent-network attack vector (AV:A) meaningfully limits reach - the attacker must already have a foothold on the same layer-2/broadcast segment as the DHCP server, not the open internet - while low complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N) make exploitation straightforward once that position is achieved. The triple-High impact reflects that a successful heap overflow in a privileged service can fully compromise the host. No EPSS score was provided, so exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC is referenced, so this is not confirmed to be actively exploited. Net assessment: a genuine priority for organizations running Windows DHCP Server on shared segments, but the adjacency requirement makes it a lateral-movement/privilege-escalation risk rather than an internet-wide worm candidate. Note the CPE strings use the 'a' (application) part rather than 'o' (operating system) despite being OS-bundled components - a minor NVD tagging inconsistency, not a substantive risk change.

An attacker who has compromised a low-privileged host on the same network segment as a Windows DHCP server (for example a foothold workstation on a flat office VLAN) crafts and sends a malformed DHCP message that overflows a heap buffer in the DHCP service. The corruption is leveraged to execute code or manipulate state in the privileged service context, elevating the attacker's privileges on the DHCP host and enabling lateral movement. No user interaction is needed and attack complexity is low, though no public POC is currently identified.