Windows DHCP Server EUVD-2026-100223

The target host must have the Windows DHCP Server role installed and running - this is a server feature, not enabled by default on standard client installs, which materially limits the exposed population even though some client SKUs (Windows 10 1607/1809) appear in the affected list. Exploitation requires the attacker to deliver a malicious DHCP message to the server, which in practice means residing on the same broadcast/network segment as the server or routing traffic through a DHCP relay agent, since DHCP is not natively routed across subnets. No authentication and no user interaction are required (PR:N/UI:N). Patch to the fixed builds (e.g. Server 2025 10.0.26100.33650, Server 2022 10.0.20348.5761, Server 2019 10.0.17763.9376, Server 2016 10.0.14393.9612) removes the condition.

Signals mostly align toward high priority but with one notable tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity code execution with total impact, and CISA's SSVC framework corroborates the severity (Technical Impact: total, Automatable: yes). CWE-122 (heap-based buffer overflow) in a network-facing service is a classic high-value RCE target, and a vendor patch is already available. However, the exploitation signals are weaker than the raw score suggests: SSVC Exploitation is 'none', there is no CISA KEV listing and no POC provided, so this is 'no public exploit identified at time of analysis' rather than active exploitation. EPSS is not provided, so probabilistic exploitation likelihood cannot be weighed. The practical caveat is scope: although CVSS marks AV:N, Windows DHCP Server traffic is normally confined to the local broadcast domain, so real-world reach is typically an adjacent-network/same-segment attacker (or via a DHCP relay) rather than arbitrary internet-wide access - verify network exposure before treating this as internet-reachable. Net assessment: a genuine high/critical-priority patch for environments running the DHCP Server role, but exploitation is currently theoretical and likely requires network-segment proximity.

An attacker positioned on a network segment served by a Windows DHCP Server (or reachable via a DHCP relay agent) sends a crafted DHCP message that overflows a heap buffer during parsing, corrupting heap memory to achieve remote code execution in the context of the DHCP service. No authentication or user interaction is required (PR:N/UI:N). No public exploit identified at time of analysis, so this currently requires attacker-developed exploit code, though SSVC rates the vulnerability as automatable.