Windows DHCP Client CVE-2026-61361

Exploitation requires an authorized local account (PR:L) - anonymous or remote network access is not sufficient per the AV:L vector. The attacker must already have the ability to execute code locally on the affected Windows 11 or Windows Server 2025 host. High attack complexity (AC:H) further constrains exploitation: triggering the use-after-free likely depends on a timing-sensitive race condition, meaning exploitation is not trivially reproducible. Systems where the DHCP Client service is disabled (e.g., hosts with static IP configuration) are not exposed to this vulnerability. What limits exploitation: the requirement for a pre-existing authorized local session, race-condition dependency raising the exploitation bar, and the absence of any confirmed public exploit or widespread exploitation campaigns at time of analysis.

CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a bounded but meaningful threat. The local attack vector eliminates remote unauthenticated exploitation entirely; combined with high attack complexity (AC:H), reliable exploitation likely requires controlled timing or environment-specific conditions. The 'Denial Of Service' tag alongside 'Use After Free' in the source intelligence suggests a crash is the more consistently achievable outcome, while arbitrary code execution may demand an additional exploitation primitive - this is inferred from tag data and AC:H, not independently confirmed. The CVE does not appear in the CISA KEV catalog and no public exploit code has been identified, further depressing near-term exploitation probability. For well-access-controlled environments enforcing least-privilege local logon, real-world risk is moderate; shared-user systems or VDI environments where multiple authorized users share a host face higher exposure. No EPSS score was provided in the source data - exploitation probability is inferred as low-to-moderate based on AC:H and absence of KEV or POC.

An authorized local user on an unpatched Windows 11 or Server 2025 system crafts a sequence of operations against the DHCP Client service designed to trigger a race condition, causing the service to access a freed heap buffer. By winning the race and controlling the memory reuse (e.g., via heap spray or allocation shaping), the attacker redirects execution flow to arbitrary code running at the DHCP Client service's privilege level. No public exploit has been identified at time of analysis, and AC:H indicates reliable exploitation requires non-trivial engineering.