Windows DHCP Server CVE-2026-70065

The Windows DHCP Server role must be installed and active on the target host. The attacker must be able to reach UDP port 67 on the DHCP server - naturally accessible from any client in the served subnet or from routed segments via DHCP relay agents. No authentication is required by either the DHCP protocol or this vulnerability (confirmed PR:N in CVSS vector). Exploitation is bounded to availability impact only (C:N/I:N/A:H); no code execution or data disclosure pathway exists. Practical exposure is constrained by network segmentation - DHCP servers are rarely internet-facing - making internal threat actors and post-perimeter attackers the primary threat actors, not external opportunistic attackers.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a high-severity, remotely exploitable DoS. In enterprise environments, Windows DHCP Server is critical infrastructure - loss of service cascades to network-wide outages as clients fail to obtain or renew leases. DHCP servers are typically reachable only from served subnets or via relay agents, providing natural segmentation that limits exposure compared to internet-facing services; however, internal threat actors or post-perimeter attackers face no authentication barrier whatsoever. EPSS data is absent from provided intelligence. No KEV listing and no known POC code exist at time of analysis, reducing immediate opportunistic exploitation risk, but the zero-complexity attack surface means the gap between patch release and active exploitation attempts may be short. Notably, the 'Authentication Bypass' tag in source metadata is mislabeled - this is a DoS via memory exhaustion, not an authentication bypass, and no confidentiality or integrity impact is present.

An unauthenticated attacker on the same network segment - or able to route UDP/67 packets through a relay - repeatedly sends crafted DHCP discovery or request packets designed to trigger the memory-leak path in dhcpserver.exe. Over a sustained packet flood, the DHCP service exhausts available memory, crashes, and stops responding to legitimate lease requests, resulting in network-wide client connectivity loss. No public POC code is known at time of analysis.