Windows DHCP Server CVE-2026-88119

Exploitation requires the target host to have the Windows DHCP Server role installed and running and reachable by the attacker over the network - a non-default role present only on servers acting as DHCP providers (commonly domain infrastructure servers), not on general-purpose or client Windows systems. No authentication or user interaction is required (PR:N/UI:N). The primary limiting factor is CVSS AC:H: the use-after-free is a timing/race-dependent condition, so successful code execution demands winning a race or reliable heap manipulation rather than a single deterministic request, reducing exploitation reliability. Affected versions span Windows Server 2012 through 2025 (including Server Core) below the patched build numbers listed in EUVD-2026-100153; patched builds are not vulnerable.

This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated code-execution flaw with full C:H/I:H/A:H impact, which drives the 8.1 'High' score. The key tempering signal is AC:H - exploiting a use-after-free (CWE-416) remotely typically requires winning a race or precise heap grooming, which lowers reliability and real-world exploit yield. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or weaponization at this time - consistent with a Microsoft-reported (secure@microsoft.com), coordinated-disclosure issue with a patch already available. Note a mild signal conflict: the Tags include 'Denial Of Service' while the description and CVSS (I:H) indicate remote code execution; a DHCP-service UAF plausibly supports both outcomes, but the authoritative description is RCE. Overall: patch on normal-to-prioritized cadence on DHCP servers given the unauthenticated network RCE potential, but AC:H and the absence of exploitation signals argue against emergency treatment.

An attacker with network reach to a Windows Server running the DHCP Server role sends crafted DHCP traffic that triggers a use-after-free in the service, then manipulates heap state to gain control of the freed object and execute code in the service context. Because the vector is AV:N/PR:N/UI:N, no authentication or user interaction is needed, but AC:H means the attacker must reliably win a memory-timing/race condition. No public exploit code was identified at time of analysis.