Windows DHCP Server CVE-2026-77893

The DHCP Server role must be installed and active on the target Windows Server; this is an optional role and is not enabled by default. The attacker requires network access to UDP port 67 on the DHCP server, which is typically reachable from any host on the same broadcast domain or via a DHCP relay agent from adjacent subnets. No authentication is required (CVSS PR:N/UI:N). Exploitation is limited to denial of service (service crash); CWE-125 out-of-bounds read does not yield code execution. Windows 10 endpoints running the DHCP Server role are also affected but represent an unusual deployment scenario outside of lab or development environments.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects network-reachable, unauthenticated exploitation with high availability impact. No EPSS data is provided in the input, so exploitation probability cannot be quantitatively assessed. No KEV listing and no public POC are identified at time of analysis, indicating this is not currently being actively exploited at scale. Despite the absence of exploitation signals, operational risk is meaningful: DHCP is infrastructure-critical, and crashing the DHCP server disrupts IP address assignment for all network clients relying on it, potentially causing widespread connectivity loss in enterprise environments. The out-of-bounds read nature of CWE-125 limits impact to DoS rather than RCE, which partially offsets the high CVSS score. Defenders running DHCP Server on any affected Windows Server version should treat this as a priority patch given the zero-interaction, unauthenticated exploitation path and the operational impact of DHCP unavailability.

An unauthenticated attacker with network access to a Windows Server running the DHCP Server role sends a specially crafted DHCP discovery or request packet to UDP port 67. The malformed packet triggers an out-of-bounds read in the DHCP service's parsing routine, causing the service to crash and terminating DHCP lease assignment for all clients on the network. No public exploit code has been identified at time of analysis, but the zero-interaction network path makes proof-of-concept development straightforward.