Windows DHCP Server CVE-2026-85841

Exploitation requires a running Windows DHCP Server role (not present on default/non-DHCP Windows installations) and an attacker who already possesses high privileges (PR:H) with network reach to the DHCP service; it does not require user interaction (UI:N). Key limiting factors: the high attack complexity (AC:H) means success depends on winning a use-after-free memory race or meeting specific timing/heap conditions that are not reliably reproducible, and the PR:H requirement means an unprivileged or fully external unauthenticated attacker cannot exploit it directly. Applying the vendor patch (builds such as Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019 <10.0.17763.9376, Server 2016/Win10 1607 <10.0.14393.9612) removes the condition.

This is a moderate-priority vulnerability that CVSS (6.6, Medium) and the SSVC framework agree is NOT a widespread-exploitation emergency, despite affecting a core Microsoft network service. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) shows that while the attack is network-reachable, it requires high privileges (PR:H - an already-authorized attacker) AND high attack complexity (AC:H - the use-after-free likely demands winning a race or satisfying specific memory-timing conditions), which substantially raises the bar. The technical impact is total (full C/I/A compromise of the DHCP server) if exploitation succeeds. CISA SSVC reinforces a lower urgency: Exploitation=none (no observed exploitation), Automatable=no (consistent with AC:H and PR:H - this cannot be sprayed at scale), and Technical Impact=total. There is no CISA KEV listing and no public POC, and EPSS was not provided in the input (missing data - exploitation probability cannot be quantified here). The signals are internally consistent: a high-impact but hard-to-exploit, privilege-gated flaw. The one point worth verifying is the privilege requirement - 'authorized attacker' plus PR:H implies the attacker must already hold meaningful rights on or against the DHCP service, so this is more plausibly a lateral-movement/post-compromise or malicious-insider scenario than an internet-facing unauthenticated RCE.

An attacker who already holds authorized/privileged access on the network sends crafted DHCP protocol traffic to a vulnerable Windows DHCP Server, manipulating object lifetime to trigger a use-after-free in the service. By winning the required memory race (AC:H) they reclaim the freed allocation with controlled data and achieve code execution in the DHCP service context. No public exploit code or active exploitation has been identified at time of analysis.