EUVD-2026-56369
GHSA-gj4w-3mrx-24m9
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
DHCP protocol scopes attack to adjacent network; clients send unauthenticated requests by design; only confidentiality is impacted via out-of-bounds read with no write primitive.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
AnalysisAI
Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.
Technical ContextAI
The root cause is an integer underflow (CWE-125, Out-of-Bounds Read) in the Windows DHCP Server service. When the server parses an incoming DHCP protocol message (UDP port 67), a length or offset computation wraps around to a very large unsigned integer value, causing a subsequent memory read to extend beyond the intended buffer boundary. The contents of that overread region - potentially including lease tables, server configuration data, or other in-memory artifacts - can be returned to the requesting client. DHCP is a Layer 2-scoped protocol, so the attack surface is inherently confined to broadcast domains or adjacent segments. Affected products span a wide range: Windows Server 2012 through 2025 (including Server Core variants) and Windows 10 versions 1607 and 1809, all of which can host the DHCP Server role. The advisory is tracked under ENISA EUVD-2026-56369 in addition to NVD. The 'Buffer Overflow' tag in source metadata is imprecise - CWE-125 classifies this as an out-of-bounds read, consistent with information-disclosure-only impact and the absence of any integrity or availability component in the CVSS vector.
RemediationAI
Apply the Microsoft-released patches for each affected platform via Windows Update or the Microsoft Update Catalog: Windows Server 2025 and Server Core to build 10.0.26100.33296 or later; Windows Server 2022 to 10.0.20348.5499 or later; Windows Server 2019, Server Core, and Windows 10 Version 1809 to 10.0.17763.9115 or later; Windows Server 2016, Server Core, and Windows 10 Version 1607 to 10.0.14393.9418 or later; Windows Server 2012 R2 and Server Core to 6.3.9600.23337 or later; and Windows Server 2012 and Server Core to 6.2.9200.26279 or later. Full details and update packages are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62742. Where immediate patching is not feasible, restrict network-level access to UDP port 67 on DHCP servers using firewall ACLs or VLAN segmentation, limiting which hosts can send DHCP requests - this reduces the attacker pool but does not eliminate risk for systems on the same broadcast domain. Disabling the DHCP Server role entirely on any system that does not operationally require it eliminates the attack surface with no trade-off other than the loss of that DHCP service.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today