Windows DHCP Server CVE-2026-69405

The attacker must be present on the same network segment as the Windows DHCP Server (AV:A - same subnet, VLAN, or adjacent broadcast domain; not exploitable from the internet). Low-privilege authorization is required (PR:L - the description explicitly states 'authorized attacker', ruling out fully anonymous exploitation). No user interaction is required. The Windows Server DHCP Server role must be installed and active. Exploitation is limited to availability impact; confidentiality and integrity of DHCP data are not affected. Factors limiting risk include: adjacency boundary (cannot traverse routers without relay configuration), authentication requirement, and the absence of any confirmed public exploit or active exploitation.

The CVSS base score of 5.7 (Medium) accurately reflects the constrained threat model: AV:A limits attacker reach to the local network segment, and PR:L (authorized attacker per the description) requires some level of network authentication or credential. The impact is confined to availability (A:H) with C:N and I:N, so data exfiltration or configuration tampering are not in scope. No CISA KEV listing and no POC are noted, reducing urgency relative to a critical, remotely exploitable flaw. Real-world risk is highest in environments where the DHCP Server role is exposed to untrusted authenticated users on the same VLAN - a common scenario in shared enterprise or campus networks. The vulnerability is not automatable without adjacency, limiting mass-exploitation potential. EPSS data was not supplied; the bounded attack vector and authentication requirement suggest low-to-moderate exploitation probability.

An authenticated user on the same subnet as a vulnerable Windows DHCP Server sends a high volume of crafted DHCP requests designed to trigger the allocation path that omits memory deallocation. Over time the DHCP Server process's working set grows until the host's available memory is exhausted, causing the DHCP service to stop responding and denying IP assignment to all legitimate network clients on that segment. No public proof-of-concept tooling for this specific vulnerability is known at time of analysis.