EUVD-2026-56439
GHSA-r9x2-vg45-q8vq
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent network vector is correct as DHCP is a broadcast-domain protocol; no credentials required; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.
AnalysisAI
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Technical ContextAI
The Windows DHCP Client is the core networking component responsible for dynamic IP address assignment on virtually all Windows endpoints and servers. CWE-400 (Uncontrolled Resource Consumption) indicates the client fails to enforce adequate bounds on resource allocation - such as memory, buffers, or processing threads - when handling inbound DHCP traffic on the local broadcast domain. DHCP operates at the link layer (UDP ports 67/68), meaning all devices on the same Layer 2 segment can send unsolicited DHCP messages to any client. A flaw in this processing path allows a crafted or high-volume packet sequence to exhaust client-side resources without requiring any handshake or credential exchange, consistent with PR:N and AV:A in the CVSS vector. The affected CPE encompasses Windows 11 builds 10.0.26100.x, 10.0.26200.x, and 10.0.28000.x, as well as Windows Server 2025 (including Server Core).
RemediationAI
Apply the Microsoft security update through Windows Update or WSUS, targeting the following minimum fixed builds: Windows Server 2025 to 10.0.26100.33296 or later, Windows 11 24H2 to 10.0.26100.9168 or later, Windows 11 25H2 to 10.0.26200.9168 or later, and Windows 11 26H1 to 10.0.28000.2704 or later. Update guidance and package links are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65785. Where immediate patching is not feasible, enforce DHCP snooping on managed switches to filter unsolicited or malformed DHCP packets at the network layer - this reduces exploitability but does not eliminate it and may cause side effects if legitimate DHCP relay configurations are present. Additionally, strict VLAN segmentation isolating untrusted endpoints from production Windows hosts reduces the attacker's ability to reach the adjacent network boundary, though it does not address the underlying flaw.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today