Windows DHCP Client CVE-2026-54128

Exploitation requires local access to the target Windows system (AV:L) with the DHCP Client service running, which is its default state on virtually all Windows installations that obtain addressing dynamically. No authentication (PR:N), no elevated privileges, and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so on an affected host an already-present local actor faces few barriers. The principal limiting factors are the need for local presence rather than remote reach and the requirement that the target run an unpatched, affected Windows/Windows Server build; hosts configured with static IP and the DHCP Client service disabled would not expose the vulnerable code path. The description phrase 'execute code locally' aligns with the Local attack vector - verify with the MSRC advisory whether malicious DHCP server responses can serve as the trigger delivery.

The signals are mixed but lean toward a genuine patch-priority item. CVSS 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes low-complexity, no-privilege, no-interaction local exploitation yielding full confidentiality, integrity, and availability impact. Notably, the attack vector is rated Local (AV:L) even though the DHCP client inherently processes attacker-influenced network responses; this AV:L rating combined with 'execute code locally' in the description suggests Microsoft assessed the practical trigger as requiring local presence rather than pure remote/adjacent delivery - verify the exact trigger path with the MSRC advisory before assuming remote exploitability. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation; real-world risk is elevated by the ubiquity of the affected code but tempered by the local vector and absence of known exploitation.

An attacker who has gained a local, unprivileged foothold on a Windows host (for example via a low-privilege account or prior malware execution) triggers the use-after-free in the DHCP Client service to corrupt heap memory and execute arbitrary code in the service's context, escalating impact on the machine. No user interaction and no elevated privileges are required per the CVSS vector, and low attack complexity means the trigger is reliable. No public POC is referenced at time of analysis.