Windows DHCP Server CVE-2026-77502

No special end-user conditions are required from the victim side. The vulnerable code path is exercised by malformed DHCP client packets arriving at the DHCP Server service (UDP port 67). The only deployment prerequisite is that the Windows DHCP Server role must be installed and active on the target host - this is a role explicitly deployed by administrators, not enabled by default on all Windows Server installs. Exploitation is possible from any network-adjacent or routed host capable of sending UDP DHCP packets to the server, including through DHCP relay agents (IP helpers), which extends reach beyond a single subnet. Limiting factors: the DHCP Server role must be explicitly configured and running; Windows 10 workstations are not affected in typical deployments even if listed in version data, as the DHCP Server role is rarely installed on workstations.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects the core threat: unauthenticated remote denial of service with low attack complexity. The absence of confidentiality or integrity impact limits the ceiling, but A:H is significant given that DHCP outages in enterprise networks immediately halt IP address assignment, blocking new device connectivity and causing operational disruption. Even a mid-sized municipal IT team in opole should treat this as urgent given the breadth of affected Windows Server versions spanning 2012 through 2025. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, which moderates immediate exploitation probability despite the favorable attacker posture. EPSS data is not provided, but AV:N/AC:L/PR:N combinations historically attract rapid proof-of-concept development once details surface. The 'Information Disclosure' tag in the input metadata is inconsistent with the CVSS C:N metric and the DoS-only description and should not factor into risk decisions.

An attacker positioned on any network segment served by the vulnerable Windows DHCP Server - or routable to it via a DHCP relay agent - sends a specially crafted DHCP DISCOVER or REQUEST packet containing malformed option fields. The server's packet parser reads beyond the allocated option buffer, triggering an access violation that crashes the DHCP service and denies IP address assignment to all clients in the scope. No authentication or prior session state is required; the attack can be repeated to prevent service recovery.