What is the CVSS score of EUVD-2026-43798?

EUVD-2026-43798 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Windows DHCP Client are affected by EUVD-2026-43798?

A critical privilege escalation vulnerability in the Windows DHCP Client service (CVE-2026-49181, CVSS 9.8) enables network-based attackers to gain administrative control over Windows 10 and Windows…. A patch is available.

How to fix or mitigate EUVD-2026-43798?

Within 24 hours: Inventory all Windows 10 (versions 1607 and 1809) and Windows Server 2012-2025 systems in your environment, identifying those with network exposure or DHCP connectivity, and establish patching prioritization. Within 7 days: Deploy Microsoft's vendor-released security patch to all affected systems, starting with critical infrastructure, data centers, and externally-facing servers. Within 30 days: Complete patch deployment across your entire Windows fleet, validate remediation with post-patch vulnerability scanning, and document the remediation effort for compliance auditing.

Windows DHCP Client EUVD-2026-43798

| CVE-2026-49181 CRITICAL

Integer Underflow (CWE-191)

2026-07-14 microsoft

GHSA-7p5h-m8jh-5cmq

Authentication Bypass Integer Overflow Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

DHCP is a link-local broadcast protocol so AV:A (adjacent) is more accurate than AV:N; no auth or interaction needed (PR:N/UI:N) and memory corruption yields full C/I/A impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 13:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 13:53 vuln.today

cvss_changed

Severity Changed

Jul 20, 2026 - 13:53 NVD

HIGH CRITICAL

CVSS changed

Jul 20, 2026 - 13:53 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 18:36 vuln.today

CVE Published

Jul 14, 2026 - 17:05 cve.org

HIGH 7.5

DescriptionNVD

Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in the Microsoft Windows DHCP Client service, driven by an integer underflow (CWE-191) triggered when processing DHCP traffic, lets an unauthorized network attacker gain elevated privileges with full confidentiality, integrity, and availability impact. It affects a broad Windows fleet spanning Windows 10 (1607/1809) and Windows Server 2012 through 2025, including Server Core installations. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is modest at 0.76% (51st percentile), but the vendor rates it critical (CVSS 9.8) and CISA SSVC flags it as Automatable.

Technical ContextAI

The flaw resides in the Windows DHCP Client component, which is responsible for obtaining IP configuration by exchanging DISCOVER/OFFER/REQUEST/ACK messages with a DHCP server and parsing the returned options (lengths, lease times, option payloads). CWE-191 (integer underflow/wraparound) means a length or size calculation on attacker-influenced DHCP fields drops below zero and wraps to a very large unsigned value, corrupting subsequent memory handling in the client. Per the CPE and EUVD data, the affected code ships across the Windows NT line: Windows 10 1607/1809 (10.0.14393 / 10.0.17763), Server 2012 and 2012 R2 (6.2.9200 / 6.3.9600), Server 2016 (10.0.14393), 2019 (10.0.17763), 2022 (10.0.20348), and 2025 (10.0.26100), including Server Core builds where the DHCP client is still present.

RemediationAI

Apply the Microsoft security update for CVE-2026-49181 from the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49181); patch availability is confirmed by the vendor. Vendor-released patched builds are: Windows 10 1607 / Server 2016 to 10.0.14393.9339, Windows 10 1809 / Server 2019 to 10.0.17763.9020, Server 2012 to 6.2.9200.26226, Server 2012 R2 to 6.3.9600.23291, Server 2022 to 10.0.20348.5386, and Server 2025 to 10.0.26100.33158. Where immediate patching is not possible, compensating controls include enabling DHCP snooping and port security on managed switches to block rogue DHCP servers and constrain which hosts can answer DHCP on a segment (trade-off: requires switch support and careful trusted-port configuration or clients lose leases); segmenting/isolating untrusted devices off the same L2 broadcast domain as sensitive hosts (trade-off: network redesign effort); and, for statically-addressed servers that do not require DHCP, disabling the DHCP Client service (dhcp) (trade-off: breaks any dynamic addressing, DNS registration, and features that depend on the service, so validate before disabling). These are stopgaps - the update is the definitive fix.