Windows DHCP Server EUVD-2026-100154

Exploitation requires the target host to have the Windows DHCP Server role installed and running, with the DHCP service (UDP port 67) reachable by the attacker over the network; the affected builds are Windows Server 2012 through 2025 (including Server Core) below the fixed versions listed in the EUVD advisory. No authentication (PR:N) and no user interaction (UI:N) are needed. The principal limiting factor is attack complexity (AC:H): the use-after-free is a memory-corruption/race condition that demands precise timing and heap manipulation, so exploitation is not guaranteed on a single attempt. In practice DHCP servers are frequently placed on internal/management network segments rather than exposed to the internet, which further constrains the realistic attacker population.

This is a genuinely serious but not top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a remote, unauthenticated code-execution flaw with no user interaction, and the C:H/I:H/A:H impact plus SSVC 'Technical Impact: total' confirm that successful exploitation yields full compromise of the DHCP server. However, several signals temper the raw 8.1 score: AC:H indicates exploitation is non-trivial - consistent with a use-after-free (CWE-416) that typically requires winning a race condition or precise heap grooming - and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', meaning there is no observed exploitation and the flaw does not lend itself to reliable, scaled automation. There is no CISA KEV listing and no indication of public exploit code, so this is not actively exploited at time of analysis. No EPSS score was provided, so probabilistic exploitation likelihood cannot be weighed. Net: a legitimately dangerous network RCE in a core infrastructure service that warrants prompt patching, but the high attack complexity and absence of any exploitation evidence place it below actively-exploited or trivially-automatable issues in priority order.

An attacker with network reachability to a Windows DHCP Server (UDP/67) sends a sequence of crafted DHCP messages designed to trigger the use-after-free and win the underlying race/memory-reuse condition, corrupting heap state to hijack control flow and execute code in the context of the DHCP service (typically SYSTEM). No credentials or user interaction are required, but the high attack complexity means the attacker likely needs multiple attempts and favorable timing. No public exploit identified at time of analysis.