Windows DHCP Server CVE-2026-77889

The Windows DHCP Server role must be installed and actively running on an affected Windows Server version - general-purpose Windows Server installations without the DHCP Server role are not affected. The attacker must be able to reach UDP port 67 on the target host with a crafted packet; no authentication, session state, or prior access is required. Exploitation is limited to availability impact only (service crash/DoS): confidentiality and integrity are unaffected per CVSS C:N/I:N. No special non-default configuration is required beyond the DHCP Server role being active. Internet-facing DHCP servers are unusual in most environments, so in practice the attacker typically needs to be on an adjacent network or have achieved some prior foothold enabling UDP/67 reachability.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a low-complexity, zero-authentication, network-reachable denial-of-service with high availability impact. For organizations where Windows DHCP Server is a critical infrastructure component, disruption of the service causes widespread network outages for all dependent clients. No KEV listing and no public POC have been identified at time of analysis, which somewhat reduces the urgency compared to actively exploited issues; however, the zero-friction exploitation prerequisites mean any attacker who can reach UDP/67 can trigger the bug. The 'Authentication Bypass' tag in the source metadata is not supported by the vulnerability - the CVSS PR:N metric encodes that no authentication is required, which is distinct from an authentication bypass flaw; this tag is mislabeled. The 'Memory Corruption' tag is broadly consistent with a type confusion root cause. Prioritization should be driven by whether the DHCP Server role is exposed: internet-facing DHCP servers are rare but highest risk, while internal-only deployments are exposed only to insider or lateral-movement threats.

An unauthenticated attacker reachable over the network sends a specially crafted DHCP request packet to UDP port 67 on a vulnerable Windows DHCP Server, triggering the type confusion flaw in the service's packet parsing logic. The server accesses memory using an incompatible type, causing the DHCP Server process to crash. Network clients dependent on the server for IP address assignment lose connectivity until the service is manually restarted or the host is rebooted. No public POC has been identified at time of analysis.