Windows DHCP Server EUVD-2026-56370

The Windows DHCP Server role (not installed by default on Windows Server) must be explicitly enabled and running on the target system - standard Windows Server installations without this role are not affected. The attacker must be positioned on the same Layer 2 broadcast domain as the DHCP server, or must be able to send crafted DHCP packets through a UDP relay agent that forwards traffic to the server. No authentication is required per CVSS PR:N. Exploitation is bounded by the adjacent network requirement (AV:A): direct internet-based attacks are not possible without first gaining access to an internal network segment. Non-default role installation, network segmentation, and relay-agent ACLs all limit realistic attacker reach. The flaw does not enable code execution, privilege escalation, or denial of service - only memory disclosure.

The CVSS 6.5 Medium score is broadly appropriate. The AV:A constraint is the primary risk-reducer: exploitation requires the attacker to be on the same Layer 2 segment as the DHCP server or route through a relay agent, eliminating direct internet-facing exposure. AC:L and PR:N indicate low complexity and no authentication, which increases accessibility once network positioning is achieved. The impact is strictly informational - C:H with I:N and A:N - meaning no service disruption or data manipulation is possible via this flaw alone; however, C:H suggests meaningful memory contents could be leaked (potentially including credentials, session tokens, or configuration data resident in the DHCP service process). SSVC rates automatable as 'no,' consistent with the need for network proximity rather than simple internet-scale scanning. No CISA KEV listing and no known POC further reduce urgency. The realistic threat actor is an insider, a compromised endpoint already on an internal segment, or an attacker who has established a foothold and is performing lateral reconnaissance. This is a real priority for environments where the DHCP Server role is deployed but ranks below internet-facing, unauthenticated RCE vulnerabilities in patching triage.

An attacker already present on the same Layer 2 network segment as a Windows DHCP Server - such as a compromised workstation, a rogue device on an internal VLAN, or an attacker routing through a DHCP relay - sends a specially crafted DHCP request packet designed to trigger the integer underflow in the server's packet-length processing logic. The underflow causes the server to perform an out-of-bounds read, returning memory contents from the DHCP service process in a response or error condition visible to the attacker. No public exploit code has been identified at time of analysis, and SSVC rates this as not automatable, implying manual construction of the malformed packet is required.