Windows DHCP Server CVE-2026-77891

The Windows DHCP Server role must be installed and actively running on the target system - systems that do not have this role enabled are not affected. The attacker must have local, authenticated access with high-level privileges (PR:H per CVSS), consistent with a local administrator or a service account with equivalent rights. High attack complexity (AC:H) imposes additional constraints, such as specific memory layout conditions, timing requirements, or multi-step preparation that cannot be reliably automated in a generic exploit. Limiting factors: exploitation is local-only (AV:L) and cannot be triggered remotely over the network; the attacker must already possess high privileges, meaning the DHCP server must first be compromised at an administrative level; the DHCP Server role must be present; and the high complexity further reduces exploitability. The vulnerability does not enable privilege escalation from unprivileged users and does not provide an initial network foothold.

The CVSS 6.4 score is appropriate and accurately reflects highly constrained exploitation conditions: AV:L (local access only, not network-reachable), AC:H (high complexity - attacker must overcome timing, memory layout, or other technical hurdles), and PR:H (attacker must already hold elevated/administrative privileges on the target server). The impact triad of C:H/I:H/A:H reflects worst-case post-exploitation outcomes if the memory corruption is successfully leveraged for code execution, potentially at SYSTEM level. No EPSS data is provided; given the absence of any KEV listing and no public POC, exploitation probability is assessed as low at this time. Real-world risk priority is moderate: patch within normal monthly update cadence rather than emergency response. The primary exposure scenario is an insider threat or a compromised admin account on a DHCP server - not an opportunistic network attacker. The 'Information Disclosure' tag in the input understates the actual confirmed impact (code execution), while 'Buffer Overflow' is a loose characterization of CWE-125 (Out-of-Bounds Read).

An authorized attacker - such as a compromised administrator account or a malicious insider - with local access to a Windows Server running the DHCP Server role crafts a specific input or sequence of operations that triggers an out-of-bounds read in the DHCP service, leaking memory layout information sufficient to defeat ASLR. The attacker uses the disclosed pointer values to construct a follow-on exploitation primitive, ultimately achieving arbitrary code execution in the context of the DHCP Server service, which typically runs as SYSTEM. High attack complexity means the attacker must account for memory layout variability and likely requires multiple attempts or precise timing. No public POC has been identified.