EUVD-2026-44141
GHSA-r7g5-hhjw-w68r
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable DHCP service (AV:N) but the double-free requires winning a heap race (AC:H) and some authorized access (PR:L); successful code execution yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows DHCP Server role (Windows Server 2012 through 2025, plus Windows 10 1607/1809) arises from a double-free (CWE-415) condition that an authorized, network-adjacent attacker can trigger to run arbitrary code in the DHCP service context. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) indicates a network-reachable but high-complexity attack requiring low-level privileges, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical rather than active for now.
Technical ContextAI
The affected component is the DHCP Server role service that ships with Windows Server, responsible for leasing IP addresses and distributing network configuration over UDP ports 67/68. The root cause is CWE-415 (Double Free): the same heap allocation is released twice, corrupting heap metadata and allocator free lists. Skilled attackers can shape the heap so that the second free, or a subsequent allocation reusing the freed chunk, yields a controllable write primitive that is escalated to arbitrary code execution inside the service process. The CPE set confirms this spans server-core and full installations of Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, and the client-side Windows 10 1607/1809 builds.
RemediationAI
Apply the Microsoft security update for CVE-2026-50685 to all systems running the DHCP Server role; the fix is delivered through the standard monthly cumulative update, and the exact build/KB should be taken from the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50685 (Vendor-released patch: available per Microsoft advisory - confirm the KB for your specific OS build there). Where immediate patching is not possible, reduce exposure by restricting which hosts can reach UDP 67 on the DHCP servers via firewall/ACLs so only legitimate DHCP relay agents and client subnets can communicate, and consider isolating DHCP infrastructure onto trusted management segments; the trade-off is that overly aggressive filtering of DHCP traffic or relays can break lease renewal and IP assignment for legitimate clients, so scope rules to known relay sources. On servers that do not actually serve DHCP, remove or disable the DHCP Server role entirely to eliminate the attack surface.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today