Windows DHCP Client CVE-2026-70250

The attacker must be on the same adjacent network / broadcast domain as the target (AV:A) - able to inject or spoof DHCP response traffic, typically via a rogue DHCP server or on-link position; the flaw is not reachable across routed/internet boundaries. Exploitation requires triggering and winning a race condition (CWE-362) in the DHCP Client service to reach the use-after-free, which introduces timing-reliability uncertainty. No authentication is required (PR:N) and no user interaction is needed (UI:N) against default configurations where the DHCP Client service is running (its default state on Windows). The primary limiting factor is the network-adjacency prerequisite, which confines the threat to hostile or shared local segments.

The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an unauthenticated, no-interaction code-execution flaw in a core Windows networking component, which on paper is high priority. However, several signals temper real-world urgency: the attack vector is Adjacent (AV:A), not Network, so exploitation is confined to the local link/broadcast domain and is NOT internet-reachable - this is a lateral-movement or hostile-LAN threat, not a mass-scanning worm vector. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation: this is 'no public exploit identified at time of analysis.' There is also a signal conflict worth flagging: the CWE is CWE-362 (race condition) and the description is a use-after-free, yet Microsoft's vector rates AC:L - race-condition UAFs typically require winning a timing window, which argues for AC:H and lowers practical exploitability below what the 8.8 suggests. Net assessment: a genuinely serious patch-now issue for environments with untrusted adjacent networks (guest VLANs, shared segments), but the adjacency requirement and race-condition reliability caveat make it materially lower real-world risk than a comparable AV:N RCE.

An attacker positioned on the same local network segment as a vulnerable Windows host (e.g., via a compromised device, rogue DHCP server, or guest VLAN) sends crafted DHCP response traffic that triggers a use-after-free race in the DHCP Client service. By winning the timing window, the attacker corrupts memory to execute arbitrary code in the client's context. No public exploit code was identified at the time of analysis, and the adjacent-network requirement means the attacker must already have a foothold on the link.