Windows DHCP Server CVE-2026-62716

The DHCP Server role must be installed and actively running on the target Windows Server system - this role is not enabled by default on Windows Server and requires explicit administrator installation. The attacker must have layer-2 network adjacency to the DHCP server or must be able to route DHCP traffic to it (e.g., via a DHCP relay agent that bridges broadcast domains). No authentication is required (PR:N per CVSS vector), and no user interaction is needed. Exploitation is limited to: (1) systems with the DHCP Server role enabled, (2) attackers who can reach the server's DHCP service on UDP port 67 from the same or a bridged subnet. Internet-facing exploitation is not possible due to AV:A - DHCP is not typically routable across the public internet. Windows 10 endpoints (1607, 1809) are affected only if the DHCP Server feature is explicitly installed, which is uncommon outside lab or development environments.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 6.5 (Medium), reflecting adjacent-network reachability without authentication and high confidentiality impact. The adjacent-network attack vector (AV:A) meaningfully limits the attacker population compared to internet-facing services - exploitation requires layer-2 adjacency or routing into the DHCP broadcast domain, which reduces opportunistic internet-scale attacks. No EPSS score was provided in the source data; given the absence of KEV listing and public exploit code, real-world exploitation probability appears lower than the confidentiality impact suggests. The information disclosure impact is rated High (C:H), meaning an attacker could potentially read sensitive memory - which may include cryptographic material or credentials cached in the DHCP service process, though the exact disclosure scope is not confirmed by available data. With no active exploitation confirmed and a patch available, even a mid-sized municipal IT team in kielce would be better served prioritizing patch deployment over emergency compensating controls. The primary urgency driver is the breadth of affected Windows Server versions (2012 through 2025), meaning a large installed base requires patching.

An attacker with layer-2 network adjacency - such as a compromised host on the same VLAN or a rogue device on the corporate LAN - sends a specially crafted DHCP request packet designed to trigger the integer underflow. The DHCP Server reads out-of-bounds memory and returns the contents in a DHCP response, allowing the attacker to harvest potentially sensitive data from the server's process memory. No public exploit has been identified at time of analysis, but the unauthenticated adjacent-network vector and low attack complexity make proof-of-concept development straightforward.