Windows DHCP Server CVE-2026-88171

The target must be a Windows Server (2012 through 2025, including Server Core, and certain Windows 10 builds) with the DHCP Server role installed and reachable on the network; exploitation involves sending crafted DHCP traffic to the service. The CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N), so default DHCP deployments are exposed to any network-adjacent attacker. The key limiting factor is HIGH attack complexity (AC:H): reliably triggering and weaponizing the double free requires precise heap state manipulation or winning a race condition, so exploitation is not trivially repeatable. Hosts not running the DHCP Server role are not affected.

This is a genuinely serious but not top-tier-urgent flaw. The CVSS 3.1 base score of 8.1 reflects network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) code execution with total CIA impact, but the HIGH attack complexity (AC:H) is the decisive signal - successful exploitation of a CWE-415 double free requires winning a race or achieving precise heap grooming, which materially lowers reliable exploitability. CISA's SSVC framework corroborates a lower operational urgency: Exploitation=none, Automatable=no, Technical Impact=total - i.e., maximum damage if exploited, but no observed exploitation and no reliable mass-automation path. There is no CISA KEV listing and no POC indicated in the provided data, so this is not confirmed as actively exploited. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be incorporated. Net: a high-impact RCE in a core Windows Server role that warrants prompt patching, but the AC:H barrier plus 'Exploitation: none / Automatable: no' indicate this is currently a patch-on-cycle priority rather than an emergency, absent new exploitation signals.

A remote, unauthenticated attacker with network reachability to a Windows Server running the DHCP Server role sends a sequence of crafted DHCP messages designed to trigger a double free (CWE-415) in the service's memory handling. By carefully controlling heap state and timing, the attacker corrupts memory to achieve arbitrary code execution in the context of the DHCP service. No public exploit code is identified at time of analysis, and the HIGH attack complexity means exploitation requires reliable heap grooming or race-window control.