Windows DHCP Server CVE-2026-62814

The Windows DHCP Server role (not installed by default on all SKUs) must be actively running on the target system. The attacker must be positioned on the same Layer 2 network segment as the DHCP server or be routable through a DHCP relay agent (RFC 1542 relay) - direct internet-originating exploitation is not possible because DHCP relies on broadcast or relay forwarding, not arbitrary routing. No authentication is required (PR:N per CVSS), consistent with DHCP operating before any credential exchange. No user interaction is needed. Exploitation is inherently limited to adjacent-network attackers; an adversary without LAN access or relay agent compromise cannot reach the service. SSVC confirms the attack is not automatable, suggesting exploitation requires deliberate per-target effort rather than opportunistic mass scanning.

CVSS 6.5 (Medium) with AV:A accurately captures the bounded blast radius: the adjacent-network constraint (AV:A) means the attacker must be on the same Layer 2 segment or reachable via a DHCP relay, eliminating direct internet exploitation. The lack of privileges (PR:N) and user interaction (UI:N) reflects DHCP's pre-authentication design, but the AV:A constraint substantially reduces the exploitable population relative to a network-facing (AV:N) flaw. SSVC rates exploitation as none and the attack as non-automatable - the non-automatable rating is coherent with AV:A since each target requires distinct network positioning. Confidentiality impact is rated High in CVSS, yet SSVC downgrades this to partial technical impact, suggesting that while out-of-bounds reads can expose memory, the accessible data may be of limited sensitivity in typical DHCP server process space. Even a mid-sized municipal IT team in zabrze should treat patching as a routine priority given DHCP servers are commonly reachable from broad internal segments including guest networks and endpoint VLANs. No public POC and no KEV listing confirm this remains a patch-cycle priority rather than an emergency response item.

An attacker already present on the same LAN segment as a Windows DHCP Server - for example, an insider threat, a compromised workstation, or an unauthorized device on a guest VLAN that bridges to the server subnet - sends a specially crafted DHCP DISCOVER or REQUEST packet with a manipulated length field that induces an integer underflow in the server's parsing logic. The underflow causes an out-of-bounds read, and the server echoes a portion of its process memory back in the DHCP response. Iterating this technique could allow the attacker to reconstruct sensitive in-memory data such as authentication tokens or configuration secrets held by the service. No public POC is known at time of analysis.