Windows DHCP Server EUVD-2026-73253

Requires the target Windows host to have the DHCP Server role installed and running and reachable by the attacker on UDP port 67. No authentication, credentials, or user interaction is needed (PR:N/UI:N). The principal limiting factor is reachability: DHCP client traffic is normally link-local broadcast, so exploitation from a routed/remote position generally depends on a DHCP relay agent (IP helper) forwarding the attacker's packets to the server - attackers directly on the same broadcast domain face no such constraint. Hosts without the DHCP Server role installed are not exploitable via this vector.

All signals point to genuinely high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact, and the affected component is exposed network infrastructure. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active exploitation or public exploit code yet - the risk here is driven by the vulnerability class and exposure, not by observed weaponization. One caveat worth verifying with the vendor: DHCP DISCOVER traffic is normally link-local broadcast, so purely remote (routed) exploitation typically depends on DHCP relay agents forwarding attacker traffic across subnets; Microsoft nonetheless rates this AV:N. The tag set lists 'Denial Of Service' first, which understates the impact - the description and CVSS clearly indicate remote code execution, with DoS being at most a secondary outcome of the same memory corruption.

An attacker on a reachable network segment (or forwarded in via a DHCP relay agent) sends a sequence of crafted DHCP packets that drive the server into freeing a heap object and then referencing it again, reclaiming the freed memory with attacker-controlled data to hijack execution. With no authentication or user interaction required, this yields code execution in the DHCP service context on a core infrastructure server. No public POC is identified at time of analysis.