Windows DHCP Server CVE-2026-62823

The Windows DHCP Server service must be installed and actively running on the target host - this role is not enabled by default on all Windows Server installations and is not present on standard Windows 10 deployments. The attacker must be able to deliver a UDP packet to port 67 of the target server, which requires Layer 2 adjacency (same broadcast domain), access via a DHCP relay agent that forwards requests to the target, or network segmentation that permits DHCP traffic to reach the server. No authentication is required and no user interaction is needed, consistent with the CVSS PR:N/UI:N metrics. Exploitation is limited to attackers who can achieve network adjacency or inject DHCP relay traffic - remote unauthenticated exploitation from the public Internet is not directly possible without a pivot. Specific non-default conditions that limit exposure include DHCP snooping enforcement at the switching layer and network segmentation that isolates the DHCP server from untrusted segments.

The CVSS 3.1 score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H accurately captures the severity profile: no privileges, no user interaction, and low attack complexity result in a full-triad impact on the DHCP server host. The adjacent-network requirement (AV:A) is the primary limiting factor - exploitation is not possible from the open Internet without a pivot point inside the network, a compromised relay agent, or a VLAN that routes DHCP traffic toward the target. Despite the absence of a CISA KEV listing and no confirmed public exploit code at time of analysis, the low complexity and zero-interaction nature make this highly automatable once an attacker has network adjacency, which is a common condition for internal threats, compromised IoT devices, or attackers who have breached a DMZ. DHCP servers in enterprise environments often run with elevated service privileges, meaning successful exploitation could yield SYSTEM-level access. No EPSS data was provided; however, given the adjacency constraint and the broad patch surface (13 distinct OS version/build combinations), organizations should treat this as an urgent patch-cycle priority, particularly for any DHCP servers accessible from guest networks, OT/IoT segments, or multi-tenant environments where network adjacency cannot be guaranteed to be trusted.

An attacker with access to the same network broadcast domain as a Windows DHCP Server - for example, a compromised workstation on the corporate LAN, a device on a guest Wi-Fi network bridged to the server segment, or a rogue agent connected to an OT network - crafts a malformed DHCP DISCOVER or REQUEST packet designed to overflow a heap buffer in the server process. No credentials, user interaction, or prior foothold on the DHCP server are required; the attacker simply transmits the packet and triggers arbitrary code execution, likely in the context of the DHCP service's OS-level privileges. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity rating suggests the overflow is consistently triggerable with a suitably crafted packet.