Windows DHCP Client EUVD-2026-56648

Exploitation requires a valid, authorized local account with at least low-level privileges on the affected system (CVSS PR:L, AV:L) - remote unauthenticated exploitation is not possible. The DHCP Client service must be running, which is the default configuration on virtually all Windows 11 and Server 2025 installations. No non-default configuration setting or specific feature enablement is required beyond the presence of a local session. Exploitation is bounded by the prerequisite of prior local authentication: a threat actor must first compromise a low-privilege account via a separate initial access vector (e.g., phishing, credential stuffing, or physical access) before leveraging this flaw. Exploitation does not require user interaction or elevated initial privileges beyond a standard user account.

The CVSS 7.8 High rating is well-supported by the AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector - low attack complexity and no user interaction mean that any attacker who has obtained a foothold on the host can reliably escalate to SYSTEM with minimal friction. The unchanged scope (S:U) limits blast radius to the compromised host, which tempers the systemic risk compared to a network-propagating flaw. No EPSS score was provided in the input data, so quantitative exploitation probability cannot be assessed; however, the combination of low attack complexity and no public exploit identified at time of analysis suggests this is a high-priority patch rather than an emergency incident response situation. The CVE is not listed in the CISA KEV catalog as of this analysis. Privilege escalation vulnerabilities of this class are routinely chained with initial access vectors in targeted intrusion campaigns - even a mid-sized municipal IT team in inowroclaw should treat this as urgent, since the DHCP Client is enabled by default and low-privilege local accounts are common in enterprise environments. The availability of a vendor patch makes remediation the primary control.

An attacker who has already obtained a standard low-privilege user session on a target Windows 11 or Server 2025 host - for example via phishing or credential theft - triggers a heap-based buffer overflow in the DHCP Client service by invoking a crafted local operation that causes the client to write beyond a heap buffer boundary. Successful memory corruption redirects execution into attacker-controlled code running in the context of the DHCP Client service process, which holds SYSTEM-level privileges, granting the attacker full control of the host. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates that exploitation does not require heap grooming or other sophisticated techniques once a reliable trigger is identified.