Windows DHCP Server EUVD-2026-73247

The Windows DHCP Server role must be explicitly installed and actively running on the target system - it is not present by default on any Windows edition and requires deliberate administrator configuration via Server Manager or PowerShell. Attacker requires UDP/67 network reachability to the DHCP server; no authentication, user interaction, or attacker-side privilege is required beyond that. On Windows 10 systems (1607, 1809) listed in the CPE data, the DHCP Server feature would need to be manually enabled via Windows Features, making exploitation of workstation-class systems very unlikely in practice. The primary limiting factor is role-specific deployment: only systems functioning as DHCP servers in the network are at risk.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects straightforward unauthenticated network exploitation with high confidentiality impact. Real-world risk is meaningfully bounded by the requirement that the DHCP Server role must be installed and running - this is not present by default on any Windows edition and represents a deliberate administrative choice. EPSS at 0.77% (53rd percentile) does not indicate elevated exploitation activity despite the low-barrier attack vector. No KEV listing or public PoC code exists at time of analysis. The practical concern is that DHCP Servers frequently operate on core infrastructure hosts that may also hold sensitive credential material or configuration data in memory; an OOB read leak from such a host carries non-trivial intelligence value for an attacker with network access. The absence of integrity and availability impact makes this lower priority than RCE-class DHCP vulnerabilities, but patch cadence should remain standard given the unauthenticated network vector.

An unauthenticated attacker on a network segment with UDP/67 reachability to a Windows DHCP Server sends a specially crafted DHCP Discover or Request packet containing malformed field lengths or option values that trigger the out-of-bounds read in the server's packet parser. The server reads and potentially returns memory contents beyond the intended buffer boundary, disclosing server memory to the attacker. No public exploit code has been identified at time of analysis.