Windows DHCP Server CVE-2026-96934

Exploitation requires that the target host is running the Windows DHCP Server role and that its DHCP service is reachable by the attacker over the network; the flaw is in that server component's message processing. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication and no user interaction are needed, so any unauthenticated host able to deliver DHCP protocol traffic to the service can attempt it. Limiting factors: only systems with the DHCP Server role installed and enabled are affected (ordinary clients and servers without this role are not), and exposure is bounded by network segmentation - DHCP is typically a LAN/segment-scoped service, so practical reach is usually limited to the broadcast domains or routed segments where the server accepts requests. Fixed builds are available (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019/Win10 1809 <10.0.17763.9376, Server 2016/Win10 1607 <10.0.14393.9612), so unpatched versions below those thresholds are the exposed population.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) describes remote, unauthenticated, low-complexity code execution with full confidentiality, integrity, and availability impact - the most dangerous combination. The affected component is the Windows DHCP Server role, a network-facing service that processes attacker-controllable packets, which is consistent with the network attack vector. Mitigating signals: no CISA KEV entry and no public proof-of-concept are present in the provided data, so there is no evidence of active exploitation or a published exploit yet. EPSS was not supplied, and no SSVC decision data was provided, so automatability and exploitation-maturity cannot be scored from the input. One inconsistency to flag: the input Tags list 'Denial Of Service', but the description and CVSS (C:H/I:H/A:H, 'execute code over a network') describe remote code execution, not merely DoS - treat this as an RCE-class memory-corruption bug (CWE-416 use-after-free). Net: prioritize patching on internet- or segment-exposed DHCP servers given the critical pre-authentication RCE profile, while recognizing that no in-the-wild exploitation is currently confirmed.

An attacker with network reachability to a vulnerable Windows DHCP Server sends crafted DHCP protocol messages that trigger a use-after-free in the server's packet-handling code, corrupting memory to gain control of execution. Because the CVSS vector indicates no authentication and no user interaction are required, a single malicious packet flow to the listening service can lead to code execution in the DHCP service context. No public exploit code was identified in the provided data, so this scenario is inferred from the use-after-free class and the network/unauthenticated vector rather than a demonstrated PoC.