Windows DHCP Server EUVD-2026-100152

The target host must be running the Windows DHCP Server role (not installed/enabled by default on a base Windows Server) and be reachable on the DHCP service by the attacker, typically meaning the attacker is positioned on a network segment that can deliver DHCP traffic to the server. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any unauthenticated network-adjacent attacker qualifies. The primary limiting factor is the high attack complexity (AC:H): reliably triggering and exploiting the use-after-free requires winning a timing/heap-state race and defeating Windows memory-protection mitigations, so exploitation is conditional on the specific pre-patch build (e.g., Server 2025 <10.0.26100.33650, Server 2019 <10.0.17763.9376) and on successful heap grooming rather than a single deterministic request.

This is a credible, high-priority vulnerability but not a drop-everything emergency based on current signals. The CVSS vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw in Windows DHCP Server with full C:H/I:H/A:H impact, consistent with the CWE-416 use-after-free that can be driven to remote code execution. The key dampener is AC:H: use-after-free RCE in a network service almost always requires winning a memory-state race and defeating modern Windows mitigations (ASLR, heap hardening, CFG), which makes reliable weaponization non-trivial. Exploitation status is 'no public exploit identified at time of analysis' - the CVE is NOT in CISA KEV and no POC is referenced, and no EPSS score was supplied, so the real-world exploitation-probability signal is MISSING and cannot be used to raise or lower priority. No SSVC decision data (automatable, exploitation, technical impact) was provided in the input. Signals are internally consistent (no CVSS-vs-description conflict), so the main uncertainty is operational: the raw 8.1 score overstates near-term ease of exploitation given AC:H and the absence of any observed exploit activity. Treat as a priority patch for any host running the DHCP Server role, but widespread opportunistic exploitation is not currently evidenced.

An attacker with network access to a Windows Server running the DHCP Server role sends a sequence of crafted DHCP packets designed to trigger the use-after-free in the service, corrupting freed heap memory. By grooming the heap and winning the required timing window (reflected in the high attack complexity), the attacker coerces the freed object's reuse into controlled code execution in the DHCP service context. No public exploit code is identified at the time of analysis, and no authentication is required (PR:N).