EUVD-2026-56355
GHSA-rpch-9pg9-35r7
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
DHCP is an adjacent-network protocol; PR:N confirmed as no auth needed; C:H for memory disclosure; I:N and A:N as only read impact described.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
AnalysisAI
Out-of-bounds memory read in the Windows DHCP Server service exposes sensitive server memory to unauthenticated attackers on the adjacent network. The root cause is an integer underflow (CWE-125) in DHCP packet processing, where a miscalculated length or index wraps around, causing the service to read and potentially return memory beyond intended buffer boundaries. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Windows Server versions via the August 2026 Patch Tuesday cycle.
Technical ContextAI
The Windows DHCP Server is a built-in network service role available on Windows Server platforms, responsible for dynamically assigning IP configuration to LAN clients via the DHCP protocol (UDP/67-68). The vulnerability is classified as CWE-125 (Out-of-Bounds Read) triggered by an integer underflow - a condition where an arithmetic operation on an unsigned integer produces a result smaller than zero, wrapping to a very large positive value. This causes the DHCP parsing or response-construction logic to reference memory well beyond the intended buffer boundary, reading unintended process memory that may then be included in a crafted DHCP response packet returned to the requester. Affected CPE strings span Windows Server 2012 R2 through Windows Server 2025, confirming the flaw resides in code shared across multiple generations of the Windows DHCP Server implementation.
RemediationAI
The primary remediation is to apply the vendor-released patches from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62715. The patched build targets by platform are: Windows Server 2012 R2 to build 6.3.9600.23337 or later, Windows Server 2016 and Windows 10 1607 to build 10.0.14393.9418 or later, Windows Server 2019 and Windows 10 1809 to build 10.0.17763.9115 or later, Windows Server 2022 to build 10.0.20348.5499 or later, and Windows Server 2025 to build 10.0.26100.33296 or later. As a compensating control where immediate patching is not feasible, restrict access to the DHCP Server's UDP ports 67 and 68 via host-based firewall rules or network ACLs to permit only traffic from known and trusted client subnets, reducing the pool of potential attackers; note this trade-off may disrupt legitimate DHCP service for unincluded segments and requires careful scope definition. Additionally, consider migrating the DHCP Server role off systems that also host domain services or sensitive workloads to limit the value of any memory disclosure.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today