Windows DHCP Client CVE-2026-69777

Exploitation requires the attacker to be on the same adjacent network (Layer-2 broadcast domain - LAN, VLAN, or Wi-Fi segment) as the target. The attacker must hold low-privilege authenticated access to the system or network (PR:L per CVSS). The Windows DHCP Client service must be running and actively processing DHCP traffic, which is the default state for Windows 11 endpoints obtaining IP addresses dynamically. Exploitation is limited to Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds; Windows 10, Windows Server, and Windows 11 versions prior to 24H2 are not listed as affected. Statically-configured hosts with DHCP disabled would not be exposed to this specific attack path.

The CVSS 3.1 score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a meaningful but constrained attack surface. The adjacent network vector (AV:A) limits exploitation to attackers on the same LAN, VLAN, or Wi-Fi segment, ruling out remote internet-facing exploitation. The PR:L requirement means the attacker must hold some form of authorized access - likely a valid domain or local account - before exploiting the heap overflow to further escalate. The combination of AV:A and PR:L substantially reduces the exploitable population compared to a fully network-accessible, unauthenticated flaw. EPSS data is not provided; however, the absence of KEV listing and public POC suggests no active mass exploitation. Despite the full C:H/I:H/A:H impact triplet, real-world risk priority should be moderate: this is a serious internal lateral-movement or insider-threat vector rather than an internet-facing critical. Enterprise environments with open internal LANs (e.g., flat Wi-Fi networks, shared office segments) face the greatest realistic exposure.

An authenticated attacker with low-privilege access (e.g., a domain user on a corporate workstation) connected to the same LAN or Wi-Fi segment as a target Windows 11 machine stands up a rogue DHCP server and sends crafted DHCP responses containing malformed option fields that trigger the heap overflow in the victim's DHCP Client service. Successful exploitation overwrites heap control structures or function pointers, redirecting execution flow to attacker-controlled shellcode running at elevated (e.g., SYSTEM) privilege. No public proof-of-concept is known, meaning exploitability requires independent vulnerability research at this time.