Windows DHCP Server CVE-2026-62718

Exploitation requires that the target system have the Windows DHCP Server role explicitly installed and actively running - this role is not enabled by default on any Windows Server or Windows 10 edition and must be deliberately configured by an administrator. The attacker must be positioned on the same Layer 2 broadcast domain or directly adjacent network segment as the DHCP server (AV:A per CVSS vector), excluding remote internet-based attacks entirely. No authentication is required (PR:N per CVSS vector) and no user interaction is needed. Exploitation is further constrained by SSVC 'Automatable: no,' indicating that reliably inducing the integer underflow condition is not trivially scriptable. The impact is limited to information disclosure only - no code execution or denial of service - meaning the vulnerability's standalone utility is confined to memory reconnaissance. Systems not running the DHCP Server role are not affected regardless of Windows version or build number.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 6.5 Medium, reflecting high confidentiality impact with no integrity or availability loss, requiring no authentication and no user interaction, but constrained to the adjacent network. A notable tension exists between the CVSS C:H rating and the SSVC technical impact of 'partial' - this discrepancy likely reflects that while memory disclosure is possible, the content of leaked memory is not guaranteed to contain exploitable material such as credentials or cryptographic keys in every scenario. The SSVC 'Automatable: no' determination is a meaningful limiting signal, suggesting reliable triggering of the underflow requires non-trivial packet crafting rather than a simple spray-and-pray approach. Absence from CISA KEV and the SSVC 'Exploitation: none' status confirm no observed active exploitation at time of analysis. No EPSS score was provided in the source data, leaving probabilistic exploitation likelihood unquantified from that signal. For organizations operating Windows DHCP Server in enterprise or government networks - even a mid-sized municipal IT team in olsztyn should treat this as a scheduled-maintenance priority rather than an emergency out-of-band response, unless the DHCP server is on a network segment accessible to untrusted or guest hosts, which would elevate urgency. The primary realistic threat is insider or lateral-movement scenarios where an attacker already on the network segment harvests leaked memory to support further compromise.

An unauthenticated attacker on the same network segment as a Windows DHCP Server sends a specially crafted DHCP request packet engineered to trigger an integer underflow in the server's packet-parsing logic, causing an out-of-bounds memory read. The server's response may include fragments of process memory - potentially containing session tokens, cached credentials, or other sensitive in-memory data - which the attacker captures and analyzes. No public exploit code has been identified at time of analysis, and the SSVC 'Automatable: no' rating suggests reliable exploitation requires tailored packet construction rather than a generic tool.