Windows DHCP Server EUVD-2026-73270

The Windows DHCP Server role must be installed and running on an affected Windows Server (or Windows 10) build - this role is not enabled by default and must be explicitly configured by an administrator. The attacker requires network-level reachability to UDP port 67 on the target; in standard LAN deployments this limits exploitation to the local subnet, but DHCP relay agents (a common enterprise configuration) extend reachability to any routed network with relay enabled toward the server. No authentication, user interaction, or special account privilege is required - the DHCP protocol itself is unauthenticated. There is no confidentiality or integrity impact; the only exploitable outcome is a service crash causing DoS.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a straightforward, unauthenticated network-reachable DoS against a critical infrastructure service. Impact is pure availability - confidentiality and integrity are unaffected, making the 'Information Disclosure' tag in the input metadata factually incorrect. EPSS data is not provided; given the DoS-only impact and absence of KEV listing, opportunistic mass exploitation is unlikely but targeted disruption of enterprise networks (which depend on DHCP for client connectivity) is plausible. The wide version range (Server 2012 through 2025) increases aggregate exposure. A note on AV:N: standard DHCP is subnet-local (broadcast), which would favour AV:A; however, Microsoft's AV:N rating is defensible given ubiquitous DHCP relay deployment in enterprise environments. Defenders should prioritise patching servers reachable via relay from untrusted segments or DMZ interfaces. No public exploit code or active exploitation has been identified.

An unauthenticated attacker on an adjacent subnet - or any subnet with a DHCP relay agent configured - sends a specially crafted DHCP request packet containing a malformed field to the target Windows DHCP Server on UDP port 67. The server's packet parser reads beyond the allocated buffer boundary, triggering an access violation that crashes the DHCP server process. All clients on subnets served by that DHCP instance lose the ability to obtain or renew IP address leases until the service is restarted. No public exploit code has been identified at time of analysis.