Windows DHCP Server EUVD-2026-73269

The Windows DHCP Server role must be installed and running on the target system - this is a server role not active by default on standard Windows installations, though it is commonly deployed in enterprise AD environments. No authentication is required: the attacker only needs UDP connectivity to port 67 on the target server, which is typically reachable from any host on the served subnet. The attack is network-based and requires no special configuration on the attacker's side. Limiting factors: the DHCP Server role is not installed by default on Windows client editions despite some client versions appearing in the affected list; exploitation of a client would require the role to have been explicitly installed. Perimeter firewalls that block inbound UDP/67 from untrusted sources reduce exposure but do not protect against internal network attackers.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects a straightforward network-reachable DoS with no authentication required and low attack complexity. In environments where Windows Server provides DHCP services, a successful DoS against the DHCP Server process would prevent IP address assignment, effectively denying network access to all DHCP-dependent clients - a high-impact operational disruption. The breadth of affected versions (Server 2012 through Server 2025) indicates a deep-seated code path issue rather than a regression. No EPSS data, KEV listing, or public proof-of-concept was provided in the input, so real-world exploitation probability cannot be quantified beyond the CVSS signal. EPSS and KEV status unknown - organizations should treat this as a high-priority patch given the zero-authentication requirement and wide version coverage. The 'Authentication Bypass' tag in the input is inconsistent with both the description and CVSS (no I: or auth-related impact) and should not factor into risk assessment.

An attacker on the same network segment - or any host with UDP connectivity to port 67 - sends a specially crafted DHCP packet containing a malformed data type that triggers the type confusion path in dhcpserver.exe. The service misinterprets a memory structure and crashes, stopping IP address assignment for all network clients until the service is manually restarted. No account credentials or prior access are required; the attack is repeatable to sustain the outage.