Windows DHCP Server EUVD-2026-56369

The Windows DHCP Server role must be explicitly installed and actively running on the target system - it is not enabled by default on any Windows Server edition, so this vulnerability does not affect default-configured hosts. The attacker must be network-adjacent: on the same Layer 2 broadcast domain, or otherwise able to deliver DHCP protocol messages (UDP/67) to the server. The CVSS vector AV:A/PR:N/AC:L confirms no authentication is required from DHCP clients and attack complexity is low once adjacency is achieved. Exploitation is strictly limited to information disclosure - there is no write primitive and no availability impact. Key limiting factors: (1) DHCP Server role must be installed and running, (2) attacker must be network-adjacent - internet-sourced attacks are structurally prevented by AV:A, (3) environments that isolate DHCP servers on dedicated management VLANs with ingress ACLs significantly reduce the exploitable population.

The CVSS 3.1 score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects genuinely high confidentiality impact tempered by the adjacent-network constraint, which is the dominant risk-limiting factor here. Exploitation is not possible from the open internet - the attacker must be on the same broadcast domain or able to route DHCP requests to the server, restricting the realistic threat population to internal users, compromised endpoints on the same VLAN, or physical intruders. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, both of which reduce urgency compared to a fully weaponized flaw. That said, the low attack complexity and zero authentication requirement mean that any attacker who achieves adjacency faces no technical barrier to exploitation - even a mid-sized municipal IT team in gdynia running Windows DHCP Server on an insufficiently segmented internal network should treat this as a priority patch rather than a deferred risk. DHCP servers frequently reside on management VLANs accessible to many internal hosts, and information leaked from server memory could include network topology or credential fragments useful for lateral movement. No conflict exists between the CVSS vector and the description.

An unauthenticated attacker on the same network segment as a patched Windows Server running the DHCP Server role sends a crafted DHCP request packet designed to trigger the integer underflow in the server's message-length parsing logic. The server reads beyond the intended buffer boundary and the overread memory contents are exposed through the server's response or error path, delivering potentially sensitive in-memory data to the attacker. No public proof-of-concept exploit has been identified at time of analysis, but the AC:L/PR:N vector indicates that a crafted DHCP packet is the only tooling required once adjacent network access is established.