Windows DHCP Client CVE-2026-83677

The target must be running the Windows DHCP Client service (default on Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, including Server Core) and actively processing DHCP traffic. The attacker must be able to deliver crafted DHCP responses to the client, which in practice means presence on the same broadcast/subnet domain despite the AV:N rating; successful denial also requires sustained/repeated triggering to accumulate leaked memory. Limiting factors: no authentication or user interaction is needed (PR:N/UI:N), but impact is availability-only (no data exposure or code execution), effect is gradual rather than instant crash, and hosts patched past the listed fixed builds (e.g. 10.0.26100.9711 for 24H2, 10.0.26100.33650 for Server 2025) are not affected.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact - pure denial of service via a memory leak (CWE-401, missing release of memory after effective lifetime). The CISA SSVC framework tempers the raw score: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'yes' (the trigger can be scripted/repeated to exhaust memory), and Technical Impact is 'partial' rather than total. There is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data, so this is a real patch-worthy issue but not an emergency-grade actively-exploited threat. One important caveat: the CVSS marks AV:N (network), yet DHCP client traffic is typically link-local/same-subnet in practice, so realistic exploitation usually requires adjacency to the victim's broadcast domain rather than arbitrary internet reach - verify network exposure in your environment. Also note the input Tag 'Authentication Bypass' directly contradicts the description and CWE; this is a DoS memory-exhaustion bug, not an auth bypass, and should not drive triage.

An attacker positioned on the same network segment as a vulnerable Windows host repeatedly sends crafted DHCP responses/offers to the Windows DHCP Client service. Each malformed exchange leaks memory that is never released, and because the flaw is automatable, the attacker scripts a sustained stream until client memory is exhausted and networking/DHCP functionality degrades or fails. No public exploit code or active exploitation has been identified at time of analysis.