Windows DHCP Server CVE-2026-69416

Exploitation requires the attacker to have low-privilege access on a network adjacent to the Windows DHCP Server (PR:L, AV:A per CVSS vector) - meaning the attacker is on the same broadcast domain, VLAN, or connected via a DHCP relay agent path. The Windows DHCP Server role must be installed and actively running on a vulnerable build. No user interaction is required (UI:N). Exploitation is limited by: the adjacent-network constraint (AV:A) which prevents direct internet-sourced attacks and blocks attackers who cannot reach the DHCP Server's network segment; the PR:L requirement which means fully unauthenticated/anonymous access is insufficient; and the availability-only impact (C:N, I:N) which restricts the consequence to service disruption. Environments with DHCP servers isolated on dedicated management VLANs with ingress filtering on UDP 67/68 are not practically exploitable regardless of patch status.

The CVSS 5.7 (Medium) score accurately reflects the constrained threat model: AV:A limits attackers to the same broadcast domain or a routed relay path, and PR:L means some level of authenticated network access is required rather than fully anonymous exploitation. The impact ceiling is pure availability (A:H), with no confidentiality or integrity exposure, so data theft and lateral-movement chains are not enabled by this vulnerability alone. No EPSS score was provided and no KEV or POC signals are present, suggesting this is currently theoretical. Practical risk is highest in flat network architectures where the DHCP server resides on the same segment as untrusted or semi-trusted endpoints - a configuration that even a mid-sized enterprise or municipal IT team should remediate through VLAN isolation regardless of this CVE. Organizations that already segment DHCP servers onto dedicated management VLANs inaccessible to end-user devices face minimal realistic exposure and can treat patching as routine Patch Tuesday hygiene.

An authenticated user on the same network segment as a Windows DHCP Server - such as a corporate LAN with no management VLAN isolation - sends a specially crafted DHCP request that triggers the buffer over-read in the server's packet-processing code. The DHCP Server service crashes, causing all clients on the segment to fail lease renewal and new address assignment until an administrator restarts the service or the OS recovers. No public proof-of-concept code has been identified, but the attack requires only low-privilege adjacent network access and no user interaction.