Windows DHCP Server EUVD-2026-73266

The DHCP Server role must be installed and running on the affected Windows Server or Windows 10 host - the vulnerability does not affect standard client-mode Windows installations. An attacker must be able to deliver a UDP packet to port 67 on the target system; in many enterprise environments this is reachable from any internal network host without any authentication, as DHCP is a pre-authentication protocol. No credentials, session tokens, or prior access to the system are required (CVSS PR:N, UI:N). Limiting factors: the DHCP Server role must be explicitly installed and active; networks using hardware DHCP appliances instead of Windows DHCP Server are not affected; and network-level ACLs restricting UDP 67 to known relay agents would mitigate exposure.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects the realistic exploitation path well: DHCP servers are network-exposed by design and the protocol requires no authentication, making this trivially reachable by any host on the same network segment or routed network if UDP port 67 is reachable. The impact is limited to high availability loss (A:H) with no confidentiality or integrity component, which keeps the CVSS base at 7.5 rather than critical range. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, so real-world exploitation appears speculative rather than observed. EPSS data was not provided in the input. Even so, DHCP server availability is operationally critical - even a mid-sized municipal IT team in malbork should treat this as urgent patching work, since a crashed DHCP server prevents new client leases and can disrupt an entire network segment. The broad affected-version surface (eight distinct Windows Server SKUs plus Windows 10 1607/1809) increases aggregate exposure. No conflicting signals between CVSS and description were identified.

An unauthenticated attacker on the same network segment (or any network capable of reaching UDP port 67 on the target) sends a specially crafted DHCP packet designed to trigger the type-confusion condition during option parsing in the Windows DHCP Server service. The server dereferences packet data through an incompatible type, causing an access violation that crashes the DHCP Server service and denies DHCP lease assignments to all network clients until the service is restarted. No public exploit code has been identified at time of analysis.