Windows DHCP Server EUVD-2026-73248

The target system must have the Windows DHCP Server role explicitly installed and the DHCP Server service actively running - this role is not present in default Windows Server or Windows 10 installations and must be deliberately configured. The attacker requires network-level access to reach UDP port 67 on the target. No authentication is required (CVSS PR:N) and no user interaction is needed. Exploitation is bounded by the DHCP Server role requirement, which substantially narrows the exposed population to systems intentionally designated as DHCP infrastructure. No non-default feature flags or unusual configurations beyond the role installation itself are required.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterizes this as a remotely exploitable, unauthenticated, low-complexity information disclosure with high confidentiality impact. EPSS at 0.77% (53rd percentile) is below the typical mass-exploitation threshold, suggesting no observed broad scanning or exploitation activity at the time of scoring. The absence of a CISA KEV listing and no reported public POC further support treating this as a standard patch-cycle priority rather than an emergency. The attack surface is meaningfully constrained: only hosts deliberately configured with the Windows DHCP Server role are vulnerable, which excludes the vast majority of Windows endpoints and client-facing servers. The C:H rating is credible because DHCP server process memory may contain lease tables, credentials, or configuration data; however, the attacker cannot control which memory region is leaked, limiting predictable exploitation value. No integrity or availability impact is present. Overall, this is a real but non-critical disclosure risk best addressed through routine Windows Update deployment.

An unauthenticated attacker with network access to a Windows DHCP Server sends a specially crafted DHCP packet containing malformed option data designed to trigger an out-of-bounds read in the server's parsing code. The server reads beyond the intended buffer boundary and may return or log leaked memory contents, potentially exposing heap data such as DHCP lease records, process credentials, or other sensitive data resident in server memory. No public proof-of-concept code exists at time of analysis, but the low attack complexity (AV:N/AC:L/PR:N) indicates exploitation requires only network reachability and knowledge of the packet structure.