Windows DHCP Server EUVD-2026-35567

The Windows DHCP Server role must be explicitly installed and running on the target system - this role is not present in any default Windows installation and must be deliberately configured, making realistic targets limited to Windows Server deployments acting as network DHCP infrastructure. Local access to the host is required per the AV:L CVSS vector; this means the attacker must already have a local interactive session, shell, or equivalent local execution capability on the target machine. The description states 'authorized attacker,' which implies some level of sanctioned or authenticated access, but this directly conflicts with PR:N (no privileges required) in the CVSS vector - the exact authentication prerequisite is unresolved and must be confirmed via the MSRC advisory before making access-control decisions. Windows 10 and 11 client editions appear in the EUVD affected-version list, but the DHCP Server role is not installable on these editions, limiting practical exploitation to Windows Server systems. Exploitation is further constrained by the requirement for local presence, which rules out unauthenticated remote network-based attacks.

CVSS 6.8 Medium (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) presents a notable internal tension: the high availability impact (A:H) contradicts the description's characterization of this solely as an information disclosure issue - the out-of-bounds read can crash the DHCP Server service, causing a denial of service for all clients dependent on it. A further conflict exists between the description's phrasing 'authorized attacker' and the CVSS PR:N designation (no privileges required); these are mutually inconsistent and the true authentication prerequisite should be confirmed via the MSRC advisory before making access-control decisions. The attack is local (AV:L), significantly constraining the attacker population to those who have already obtained local system presence. EPSS data was not provided in source intelligence. No CISA KEV listing and no known public exploit code mean real-world exploitation risk is currently low, and the DHCP Server role must be explicitly installed - it is not present by default - further narrowing realistic targets to intentionally configured DHCP server infrastructure.

A threat actor who has obtained local access to a Windows Server running the DHCP Server role - via compromised credentials, lateral movement, or an initial foothold - submits crafted input to the DHCP Server component, triggering an out-of-bounds memory read in the underlying parsing routine. The read may expose sensitive adjacent memory (credentials, configuration data) with low confidentiality impact, or cause the DHCP Server process to crash, halting address allocation for the entire network segment served by that host. No public exploit code is available at time of analysis, and exploitation requires local system presence, reducing near-term opportunistic risk.