Windows DHCP Server CVE-2026-70124

No authentication is required - DHCP by design accepts unauthenticated packets from any network client, so PR:N accurately reflects the protocol's open nature. The primary prerequisite is that the Windows DHCP Server role must be explicitly installed and running on the target system; this role is not enabled by default on Windows Server or Windows 10, limiting exposure to systems where it has been deliberately deployed. Network reachability to UDP port 67 on the target server is required; standard enterprise perimeter firewalls block this port from external networks, confining realistic exploitation to internal network segments or VLANs with DHCP service access. No specific client OS, DHCP option, or non-default DHCP Server configuration is documented as a prerequisite beyond the role being active.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms unauthenticated, low-complexity network exploitation with confidentiality-only impact - there is no code execution or denial-of-service component disclosed. DHCP's broadcast nature means any LAN-adjacent host can send packets to UDP port 67 without prior network enumeration, lowering the practical bar. Despite this, EPSS at 0.77% (53rd percentile) indicates exploitation is not currently observed at scale, and the absence from CISA KEV reinforces that this is not a confirmed threat-actor target at this time. Even a mid-sized municipal IT team in sopot should treat this as urgent enough to include in the next standard Windows patch cycle, particularly on domain DHCP servers that may hold network topology, lease data, or other infrastructure details in memory adjacent to the vulnerable buffer. The most significant complicating factor is that Windows Server 2012 and 2012 R2 are end-of-life platforms; organizations relying on those systems must hold active Extended Security Update (ESU) subscriptions to receive this patch, otherwise they remain unpatched without an easy alternative.

An attacker on the same LAN segment as a Windows DHCP Server - or any host routable to UDP port 67 on that server - sends a specially crafted DHCP Discover or Request packet containing a malformed option or length field that triggers the out-of-bounds read in the server's packet parser. The server's response or a detectable behavioral side-channel reveals bytes from adjacent memory, which may include cached network configuration data, lease table contents, or other sensitive server state. No public POC is known at time of analysis, but the low attack complexity (AC:L) suggests an independent trigger could be developed by a skilled attacker through DHCP protocol fuzzing.