Windows DHCP Client EUVD-2026-56375

Exploitation requires a low-privilege authenticated session on the target Windows system (CVSS PR:L, AV:L) - an attacker must have the ability to run code locally, achieved via interactive logon, RDP session, or malware already present on the host. The DHCP Client service is enabled and running by default on virtually all Windows installations, so no special configuration is required to present the vulnerable attack surface. Attack complexity is low (AC:L), meaning no race conditions or elevated environmental dependencies are needed. Limiting factors: exploitation is strictly local - it cannot be triggered remotely without a prior foothold on the system (AV:L). There is no user interaction requirement (UI:N), and no scope change (S:U), so impact is confined to the compromised host. Systems with DHCP Client disabled or using static IP assignment only may not expose the vulnerable code path, though this has not been independently confirmed by the vendor.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N correctly characterizes this as a local privilege escalation requiring minimal preconditions beyond an existing low-privilege session. The AC:L metric is notable: it signals that no race conditions, specific timing, or non-default configurations are needed to trigger the overflow, making post-access exploitation straightforward. Full C:H/I:H/A:H impact reflects that a successful escalation yields SYSTEM-level control. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified independently. Neither a CISA KEV listing nor public POC code was identified, which moderates immediate urgency relative to actively exploited LPE flaws. However, the breadth of affected versions (19 distinct build ranges across Server 2012 through Windows 11 26H1) and the low complexity of exploitation mean that any organization tolerating untrusted local users - shared workstations, VDI environments, developer machines, or systems reachable via RDP - should treat this as a high-priority patch candidate. The absence of KEV or POC should not be interpreted as confirmed safety; it reflects the current intelligence snapshot, not absence of exploitation capability.

A low-privileged user or malware process running on a Windows endpoint crafts an operation that triggers the stack-based buffer overflow within the DHCP Client service, overwriting the stack return address to redirect execution to attacker-controlled code. Because the DHCP Client service runs with elevated privileges, successful exploitation yields SYSTEM-level code execution on the local machine, enabling the attacker to disable security controls, dump credentials, or pivot further within the environment. No public proof-of-concept exploit code has been identified at time of analysis, but the AC:L CVSS metric indicates exploitation does not require unusual conditions once local access is established.