EUVD-2026-73492
GHSA-wjf9-2x33-rp5q
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Adjacent vector and low-privilege prerequisite confirmed by description; DoS-only outcome sets C:N/I:N/A:H with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Buffer over-read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.
AnalysisAI
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have low-privilege access on a network adjacent to the Windows DHCP Server (PR:L, AV:A per CVSS vector) - meaning the attacker is on the same broadcast domain, VLAN, or connected via a DHCP relay agent path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.7 (Medium) score accurately reflects the constrained threat model: AV:A limits attackers to the same broadcast domain or a routed relay path, and PR:L means some level of authenticated network access is required rather than fully anonymous exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security updates released for this vulnerability, targeting the following minimum patched builds: Windows Server 2025 and Server Core to 10.0.26100.33438, Windows Server 2022 to 10.0.20348.5622, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9245, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9512, Windows Server 2012 R2 to 6.3.9600.23397, and Windows Server 2012 to 6.2.9200.26349. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today