Windows DHCP Server CVE-2026-62715

The Windows DHCP Server role must be installed and actively running on the target system - this role is not enabled by default and must be explicitly configured by an administrator. The attacker must be positioned on the same Layer 2 network segment, VLAN, or adjacent subnet as the DHCP Server (AV:A), preventing direct exploitation from the internet. No authentication is required (PR:N) and no user interaction is needed (UI:N), making the attack fully opportunistic for any host co-resident on the network. Exploitation is limited to systems running unpatched builds below the thresholds listed in the affected version ranges. Windows 10 versions without the DHCP Server role installed are not affected even though they appear in the version list - the role must be actively provisioned.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 6.5 (Medium), reflecting high confidentiality impact but constrained by the adjacent-network attack vector. The AV:A requirement is the primary risk limiter: exploitation demands the attacker occupy the same Layer 2 segment, VLAN, or directly adjacent subnet as the DHCP Server - precluding direct internet-facing exploitation. Within internal networks, however, the PR:N/UI:N/AC:L combination means any unprivileged host on the same LAN can attempt exploitation with no setup beyond crafting a DHCP packet. No EPSS data was provided; no CISA KEV listing is present, and no public POC code is known. The I:N and A:N metrics confirm this is strictly an information disclosure - no direct service disruption or data modification. Real-world priority should be elevated for environments where the DHCP Server role runs on domain controllers or systems holding privileged credentials in memory, as leaked memory could expose sensitive cryptographic or authentication material. The absence of KEV status and POC availability modestly reduces urgency relative to the CVSS score alone.

An attacker connected to the same internal LAN or VLAN as the Windows DHCP Server crafts a malformed DHCP DISCOVER or REQUEST packet designed to trigger the integer underflow in the server's packet-processing routine. The underflow causes the server to read beyond its intended buffer boundary and include unintended process memory in a DHCP response, which the attacker captures on the wire. No public exploit code is known, but the AC:L/PR:N conditions suggest the technique would be straightforward to implement by anyone with familiarity with the DHCP protocol and basic fuzzing tooling.