Windows DHCP Server EUVD-2026-56636

The attacker must be on an adjacent network - the same broadcast domain, VLAN, or directly routed subnet - as a Windows system with the DHCP Server role actively installed and running. The DHCP Server role is an optional Windows Server component that must be explicitly installed and started; it is not present by default on all Windows Server deployments. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required once adjacent-network access is established. Exploitation is categorically limited to AV:A: remote unauthenticated exploitation across the internet or non-adjacent network segments is not possible without first achieving Layer 2 or Layer 3 proximity. SSVC's non-automatable rating indicates the attack does not lend itself to scanner-driven mass exploitation, implying the specific malformed packet trigger is not yet widely characterized. Windows 10 systems with the DHCP Server role configured (an uncommon but valid deployment) are also in scope.

The CVSS 3.1 score of 6.5 (Medium) reflects a meaningful but bounded threat: adjacent-network, no-authentication, no-interaction required, with high confidentiality impact and no integrity or availability consequence. SSVC rates exploitation as none and the attack as non-automatable, indicating no scripted mass-exploitation tooling is currently in circulation - even a mid-sized municipal IT team in zabrze should treat this as actionable during the next patching cycle, but there is no evidence of emergency-level exploitation urgency. The AV:A constraint is the most significant mitigating factor: internet-facing, remote exploitation without prior network-layer access is not possible. No CISA KEV listing and no reported proof-of-concept further reduce near-term exploitation likelihood. The wide version spread across all actively supported Windows Server generations (2012 through 2025) increases organizational exposure simply because many environments will have at least one unpatched DHCP server. On balance, this is a genuine patch-cycle priority - particularly for environments where DHCP servers are on shared or semi-trusted VLANs - rather than a drop-everything emergency.

An attacker already positioned on the same VLAN or subnet as the Windows DHCP Server - through an insider position, a compromised workstation, or a network pivot from another system - sends a specially crafted DHCP request that causes the server to calculate a negative length value that wraps to a large unsigned integer. The DHCP service then reads beyond the legitimate packet buffer and includes the leaked adjacent memory in its response, potentially exposing contents of the DHCP service process such as leased-address tables, configuration data, or other in-memory values. No public proof-of-concept has been identified at time of analysis, meaning successful exploitation currently requires independent research to develop the precise malformed packet structure.