EUVD-2026-73267
GHSA-93h9-7vrp-g8j5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Windows Server with DHCP role
-
DeliverySend crafted DHCP packet to UDP/67
-
ExploitTrigger out-of-bounds read in packet parser
-
ExecutionDHCP service process crashes
-
PersistClients lose lease renewal
-
ImpactNetwork connectivity disruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Windows DHCP Server role must be explicitly installed and running on the target Windows Server - it is not enabled by default. The attacking host must be able to send UDP packets to port 67 on the server (either from the same subnet for broadcast or directly for unicast DHCP). No authentication is required, and no special client configuration is needed beyond network-layer reachability. Exploitation is limited by: (1) the DHCP Server role being installed, which narrows the exposed population; (2) network segmentation or firewall rules blocking UDP/67 from untrusted hosts; and (3) the impact ceiling being availability-only with no confirmed code execution or data disclosure path. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-aligned with the described impact: unauthenticated, zero-interaction denial of service over the network. EPSS data is not present in the provided intelligence, but the absence of KEV listing and public PoC reduces urgency somewhat. Real-world priority is still meaningful because DHCP infrastructure is operationally critical - even a mid-sized municipal IT team in sanok should treat this as urgent, since disrupting DHCP brings down IP provisioning for the entire managed subnet. The DoS-only impact (no confidentiality or integrity component confirmed) bounds the severity ceiling, but repeated or automated exploitation could constitute sustained network disruption. The DHCP Server role is not enabled by default, so exposure is limited to servers where the role is explicitly installed and accessible. |
| Exploit ScenarioDerived | An attacker with access to a network segment served by a vulnerable Windows DHCP Server sends a single malformed DHCP DISCOVER or REQUEST packet containing a crafted option field engineered to trigger the out-of-bounds read. The DHCP service process encounters a memory access violation and crashes, immediately preventing lease renewals and new address assignments for all clients on that subnet. No authentication, prior access, or user interaction is required; the attack is repeatable and can sustain the outage. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Out-of-bounds read in the Windows DHCP Server role exposes all supported Windows Server versions - from Server 2012 through Server 2025 - to unauthenticated network-based denial of service. An attacker on the network can send a specially crafted DHCP packet that triggers the CWE-125 read violation, crashing or hanging the DHCP service and severing lease renewal for all network clients served by that instance. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected build lines.
RemediationAI
Apply Microsoft's monthly security update addressing this vulnerability, which targets the specific build-version thresholds listed above for each Windows Server release line (the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77498 maps patch KB articles to each OS version). If immediate patching is not feasible, restrict UDP port 67 inbound access on DHCP server interfaces to authorized client subnets via Windows Firewall or perimeter ACLs - this limits the attack surface to internal network segments and removes exposure from untrusted networks, at the trade-off of requiring careful rule management if subnets change. Organizations can also consider temporarily stopping the DHCP Server service on non-critical instances until patching is complete, with static IP assignment as a stopgap for essential systems.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows DHCP Server is a built-in optional role (dhcpserver.exe / dhcpssvc.dll) that responds to UDP port 67 broadcast and unicast requests from network clients. CWE-125 (Out-of-Bounds Read) indicates the parser processes attacker-controlled packet fields without adequate length validation, causing a read past the end of an allocated buffer. In Windows networking components this class of bug is often found in packet-header parsing routines and typically manifests as a service crash (Availability:High) rather than a code-execution primitive, consistent with the C:N/I:N CVSS vector. Affected CPE spans cpe:2.3:o:microsoft:windows_server_2012, 2012_r2, 2016, 2019, 2022, and 2025 across standard and Server Core installations.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
DHCP service accepts unauthenticated network packets; out-of-bounds read yields crash only, no confidentiality or integrity impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Windows DHCP Server, foundational infrastructure in virtually all Windows Server environments, is vulnerable to remote denial-of-service attacks that crash the service and sever network connectivity for all connected clients. The vulnerability affects Windows Server 2012 through 2025, reflecting exposure across the vast majority of enterprise Windows deployments. Microsoft has released patches, but organizations must prioritize deployment urgently given the network-based attack vector and the critical nature of DHCP to business continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB