Windows DHCP Client CVE-2026-65785

Exploitation requires the attacker to be physically or logically adjacent to the target - specifically on the same Layer 2 broadcast domain such as the same Ethernet segment, VLAN, or Wi-Fi network (AV:A). No authentication credentials are required (PR:N), and no action by the target user is needed (UI:N). The target must be running an unpatched version of Windows 11 (24H2, 25H2, or 26H1) or Windows Server 2025 with the DHCP Client service active, which is the default configuration for any dynamically addressed host. Exploitation is strictly limited to availability - no code execution, privilege escalation, or data access is achievable through this vulnerability. The adjacent-network requirement is the primary limiting factor, preventing internet-based mass exploitation and confining risk to scenarios involving insider access, rogue devices on shared network segments, or compromised network infrastructure.

The CVSS 3.1 score of 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a medium-severity denial-of-service that is meaningfully constrained by the adjacent-network requirement. An attacker cannot exploit this from the internet - they must first be on the same Layer 2 broadcast domain as the victim, such as the same physical LAN, VLAN, or Wi-Fi segment. This substantially limits the threat actor population to insiders, compromised network devices, or physically co-located adversaries. Attack complexity is low (AC:L) once adjacency is achieved, and no authentication is required. Impact is strictly limited to availability (A:H); confidentiality and integrity are unaffected. No EPSS score was provided in the source data, and the vulnerability is not listed in CISA KEV, nor is any POC referenced - real-world exploitation priority is therefore lower than the ubiquity of the affected product might suggest. For enterprise environments with guest Wi-Fi or shared VLAN segments, risk is elevated relative to isolated server networks.

An attacker who has gained access to the same LAN segment or VLAN as Windows 11 or Windows Server 2025 endpoints - for example, via a rogue device on a corporate Wi-Fi network or a compromised switch - transmits crafted or volumetric DHCP packets targeting the Windows DHCP Client on unpatched hosts. The client fails to bound its resource consumption while processing these packets, exhausting memory or CPU and causing a denial of service condition on the affected host. No public proof-of-concept code has been identified at time of analysis.