Windows DHCP Server EUVD-2026-56635

Exploitation requires the attacker to have Layer 2 network adjacency to the target host - that is, to be on the same broadcast domain or subnet as the Windows Server running the DHCP role; remote internet-based exploitation is not possible without first achieving this adjacency. The DHCP Server role must be explicitly installed and actively running on the target; it is not present by default on Windows Server and must be configured as a server role by an administrator. The CVSS PR:N vector confirms that no authentication is required once adjacency is achieved, and UI:N confirms no user interaction is needed. Exploitation is bounded by: (1) Layer 2 network adjacency to the DHCP server - attackers on separate routed segments cannot directly exploit this without prior lateral movement; (2) the DHCP Server role being installed and running; and (3) the target build falling below the fixed version thresholds for each respective platform. The information-disclosure-only impact (C:H/I:N/A:N) means exploitation does not directly grant code execution or service disruption.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium) and accurately reflects the primary risk constraint: the adjacent-network (AV:A) attack vector limits exploitation to attackers sharing Layer 2 connectivity with the DHCP server, ruling out direct internet-scale mass exploitation without prior network access. Confidentiality impact is rated High, meaning successful exploitation can yield meaningful memory contents, but there is no integrity or availability impact. No EPSS score was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be cited from that source. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, which moderates urgency compared to actively exploited flaws. However, the breadth of affected platforms - six Windows Server generations including the current Server 2025 - means the exposure footprint is large among organizations that have not applied the latest cumulative updates; even a mid-sized municipal IT team in gniezno operating a mixed Windows Server estate would face real exposure if DHCP servers lag behind patch cycles. The adjacency requirement is the most meaningful risk-reducing factor: organizations with well-segmented DHCP infrastructure behind trusted VLANs face meaningfully less risk than those running DHCP servers on flat or multi-tenant networks where attacker adjacency is achievable.

An attacker who has gained Layer 2 network adjacency to a Windows Server running the DHCP Server role - for example via a compromised workstation on the same VLAN, a rogue device on an unsegmented enterprise LAN, or a malicious insider on a shared subnet - sends a crafted DHCP request containing a malformed length or offset field designed to trigger the integer underflow. The DHCP Server processes the packet, the arithmetic wrap-around causes an out-of-bounds read of adjacent process memory, and the server returns memory contents (potentially containing credentials, session data, or cryptographic material present in the DHCP server process) to the attacker's client. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and absence of authentication requirements (PR:N) suggest that a functional exploit would be straightforward to develop for an attacker with adjacent network access.