Windows DHCP Server CVE-2026-77890

No authentication or credentials are required; the DHCP protocol accepts packets from any network client by design. The Windows DHCP Server role must be installed and the service must be running - this role is not active by default on Windows 10 workstations and must be explicitly deployed on Windows Server. The attacker must have UDP network path access to port 67 on the target, either directly on the subnet or via a DHCP relay agent. Exploitation is strictly bounded to denial-of-service (A:H); no code execution, privilege escalation, or data disclosure is described or indicated by CVSS metrics (C:N, I:N). Systems that do not run the DHCP Server role - including the vast majority of Windows 10 endpoints - are unaffected even if they are within the listed version ranges.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures an unauthenticated, low-complexity, network-exploitable denial-of-service with no confidentiality or integrity consequence. The attack is automatable - a single malformed UDP/67 packet is the entire exploit - meaning even a mid-sized municipal IT team in gdynia managing dozens of DHCP-served subnets should treat this as urgent, since a crashed DHCP service prevents all clients from obtaining or renewing leases, effectively taking down network connectivity for DHCP-dependent hosts. EPSS data was not included in the provided intelligence, limiting probabilistic exploitation forecasting. No KEV listing and no public PoC reduce immediate urgency relative to the raw score, but the zero-prerequisite attack path and the sheer breadth of affected Windows Server versions (2012-2025) mean the exposure surface is enormous. The input 'Authentication Bypass' tag is factually incorrect and does not correspond to any described or CVSS-indicated impact; this is a metadata error. The 'Memory Corruption' tag is defensible given that type confusion (CWE-843) is a memory-safety class of flaw, though in this instance the outcome is DoS rather than exploitable code execution.

An unauthenticated attacker with UDP/67 reachability to a target Windows DHCP Server - whether on the local subnet or via a DHCP relay path - crafts a malformed DHCP packet designed to trigger the type confusion condition in the server's packet-parsing code. Upon receipt, the DHCP Server service dereferences the mistyped resource and crashes, immediately preventing any new lease grants or renewals on served subnets. No public PoC has been identified at time of analysis, but the attack requires only basic DHCP packet construction.