What is the CVSS score of CVE-2026-62716?

CVE-2026-62716 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-62716?

Yes, a patch is available for CVE-2026-62716. Update the affected software to the latest version immediately.

Windows DHCP Server CVE-2026-62716

EUVD-2026-56356 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-11 secure@microsoft.com

GHSA-h2x6-3938-847h

Buffer Overflow Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Adjacent-network vector matches DHCP broadcast scope; unauthenticated per protocol design; confidentiality-only impact with no integrity or availability effect confirmed.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:05 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

AnalysisAI

Integer underflow (CWE-125, out-of-bounds read) in the Windows DHCP Server service allows an unauthenticated attacker on an adjacent network segment to disclose sensitive memory contents. Affected systems span Windows Server 2012 through 2025 and certain Windows 10 builds running the DHCP Server role. No public exploit has been identified at time of analysis, and a vendor patch is available via Microsoft's July 2026 update cycle.

Technical ContextAI

The vulnerability is rooted in CWE-125 (Out-of-Bounds Read), triggered by an integer underflow (wrap/wraparound) condition in the Windows DHCP Server service (dhcpssvc.dll or equivalent). When processing malformed or crafted DHCP protocol messages, an integer value wraps below zero, causing the server to read memory outside the intended buffer boundary. DHCP operates over UDP port 67/68, making it reachable by any host on the same broadcast domain or connected subnet without authentication. Affected CPE covers Windows Server 2012 (6.2.9200.x), 2012 R2 (6.3.9600.x), 2016 (10.0.14393.x), 2019 (10.0.17763.x), 2022 (10.0.20348.x), 2025 (10.0.26100.x), and Windows 10 versions 1607 and 1809 - all prior to the patched build thresholds listed by EUVD.

RemediationAI

Apply Microsoft's security update corresponding to your Windows Server version, available through Windows Update, WSUS, or Microsoft Update Catalog as part of the July 2026 patch cycle. The fixed builds are: Windows Server 2012 at 6.2.9200.26279 or later, Windows Server 2012 R2 at 6.3.9600.23337 or later, Windows Server 2016 at 10.0.14393.9418 or later, Windows Server 2019 at 10.0.17763.9115 or later, Windows Server 2022 at 10.0.20348.5499 or later, and Windows Server 2025 at 10.0.26100.33296 or later. As a compensating control where patching is immediately infeasible, restrict DHCP server exposure by enforcing network segmentation so that only authorized DHCP relay agents and managed subnets can reach UDP port 67 on the server - this reduces the adjacent-network attacker pool but does not eliminate risk from internal threats. Disabling the DHCP Server service is a more aggressive workaround but will disrupt IP address assignment across the network. See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62716 for full advisory details.