Windows DHCP Server CVE-2026-69637

Exploitation requires the attacker to be adjacent to the target on the same Layer-2 network segment or VLAN (AV:A) and to hold low-privilege authorized access to that network (PR:L); pure unauthenticated drive-by exploitation is not possible per the CVSS vector. The Windows DHCP Server role must be actively installed and running on the target host. No user interaction is required (UI:N). Internet-based remote attackers cannot directly reach the DHCP service without first achieving network adjacency, such as through a VPN connection, compromised host pivot, or physical access to the network. The vulnerability does not require any non-default DHCP Server configuration - the default installed role is sufficient.

The CVSS 5.7 score is well-calibrated for this vulnerability. The adjacent-only attack vector (AV:A), low-privilege requirement (PR:L), and pure availability impact (C:N/I:N/A:H) collectively constrain real-world risk. An attacker cannot reach the DHCP service from the open internet without first achieving network adjacency, and must hold some form of authorized network access. That said, in enterprise environments the business impact of DHCP service loss is high: a crash denies network connectivity to all clients on the affected segment until the service is restarted or failover activates. No EPSS score was provided in the input data, and the vulnerability is absent from the CISA KEV catalog, suggesting opportunistic mass exploitation is unlikely. The absence of public POC code further supports a lower near-term exploitation probability. The 'Buffer Overflow' and 'Information Disclosure' tags in the input metadata are both inaccurate - the CWE is an out-of-bounds read (not a write/overflow), and the CVSS vector confirms no confidentiality impact - so these signals should be disregarded for triage purposes.

An authorized attacker already present on the same LAN segment or VLAN as a vulnerable Windows DHCP Server sends a specially crafted malformed DHCP request packet designed to trigger the out-of-bounds read in the server's packet processing routine. The DHCP service crashes or hangs, immediately denying IP address assignment to all clients on the segment until an administrator restarts the service. No public exploit code has been identified at time of analysis.