Windows DHCP Server CVE-2026-77886

The Windows DHCP Server role must be explicitly installed and running on the target system - this role is not enabled by default on any Windows installation and must be deliberately provisioned by an administrator. Network access to UDP port 67 on the target server is required. No authentication is needed (PR:N per CVSS), and no user interaction is required (UI:N). Exploitation impact is limited strictly to availability (A:H); CVSS C:N and I:N confirm no confidentiality exposure or integrity modification results from this specific flaw. Windows 10 workstations are listed in affected versions but rarely run the DHCP Server role in production. The vulnerability cannot be exploited against systems where the DHCP Server role has not been installed.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: any attacker with network access to UDP port 67 can crash the DHCP service without authentication or user interaction, at low complexity. The impact is purely availability - C:N and I:N are consistent with CWE-125 causing a crash rather than a controlled information leak or write primitive. The CVE is not listed in CISA KEV and no EPSS score was provided, suggesting it has not yet seen active or widespread exploitation. Nonetheless, even a mid-sized municipal IT team in gliwice should treat patching as urgent, because DHCP service disruption cascades across all network clients whose lease renewals fail, potentially causing progressive network outages for an entire subnet. The attack requires no special positioning beyond reaching UDP/67, which in flat enterprise networks is often reachable from any internal workstation or, if DHCP relay is improperly exposed, from the internet.

An unauthenticated attacker on the internal network (or with access via a DHCP relay path) sends a crafted, malformed DHCP DISCOVER or REQUEST packet to the Windows DHCP Server on UDP port 67. The packet contains field lengths or offsets that cause the DHCP service to read past the end of its allocated buffer, triggering an access violation and crashing the dhcpssvc service. All DHCP clients on affected subnets begin failing lease renewals, leading to progressive network connectivity loss across the environment.