Windows DHCP Server EUVD-2026-72967

The attacker must be positioned on the same layer-2 network segment or VLAN as the target DHCP server, satisfying the AV:A (adjacent network) requirement. Low-privilege credentials are required ('authorized attacker', PR:L) - unauthenticated exploitation is not indicated by the CVSS vector. The target system must have the Windows DHCP Server role actively installed and running; Windows systems without this role enabled are not affected. No specific non-default configuration beyond role installation is described. Exploitation from the open internet is not possible without a prior internal foothold. These constraints limit the realistic threat actor to insiders, already-compromised internal hosts, or attackers with established lateral movement capability.

CVSS 8.0 with AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a genuine high-severity finding, but the adjacent-network vector materially constrains real-world exposure compared to internet-facing RCE vulnerabilities. An attacker must already be on the same LAN segment or VLAN as the DHCP server and must possess at minimum low-level network credentials - this rules out opportunistic internet-scale scanning. No CISA KEV listing and no public proof-of-concept are identified, so EPSS-equivalent risk signals point toward theoretical rather than actively weaponized exploitation at this time. The combination of PR:L and AV:A means exploitation from the open internet is not feasible without a prior foothold; however, once an attacker has internal access, a DHCP server is a high-value lateral-movement target given its central network role. The full C:H/I:H/A:H impact is credible for a stack overflow in a privileged network service. Even a mid-sized enterprise IT team should treat this as urgent patching work, since internal threat actors or already-compromised workstations represent realistic threat models. No conflicting signals between CVSS vector and description are observed.

An attacker with low-privilege credentials on the same network segment as a Windows DHCP Server crafts a malformed DHCP protocol message designed to overflow a stack buffer in the DHCP service. The overflow overwrites the return address or function pointer on the stack, redirecting execution to attacker-controlled shellcode or a ROP chain. No public proof-of-concept is identified at time of analysis, but the primitives (adjacent network access, authenticated session, stack overflow in a network service) are well-understood by offensive practitioners.