EUVD-2026-73271
GHSA-m4p9-hm95-m54c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target DHCP server on network
-
DeliveryCraft malformed DHCP packet with out-of-bounds option data
-
ExploitSend packet unauthenticated to UDP port 67
-
ExecutionTrigger out-of-bounds read in server parser
-
PersistDHCP service crashes
-
ImpactClients denied IP assignment (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special end-user conditions are required from the victim side. The vulnerable code path is exercised by malformed DHCP client packets arriving at the DHCP Server service (UDP port 67). The only deployment prerequisite is that the Windows DHCP Server role must be installed and active on the target host - this is a role explicitly deployed by administrators, not enabled by default on all Windows Server installs. Exploitation is possible from any network-adjacent or routed host capable of sending UDP DHCP packets to the server, including through DHCP relay agents (IP helpers), which extends reach beyond a single subnet. Limiting factors: the DHCP Server role must be explicitly configured and running; Windows 10 workstations are not affected in typical deployments even if listed in version data, as the DHCP Server role is rarely installed on workstations. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects the core threat: unauthenticated remote denial of service with low attack complexity. The absence of confidentiality or integrity impact limits the ceiling, but A:H is significant given that DHCP outages in enterprise networks immediately halt IP address assignment, blocking new device connectivity and causing operational disruption. Even a mid-sized municipal IT team in opole should treat this as urgent given the breadth of affected Windows Server versions spanning 2012 through 2025. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, which moderates immediate exploitation probability despite the favorable attacker posture. EPSS data is not provided, but AV:N/AC:L/PR:N combinations historically attract rapid proof-of-concept development once details surface. The 'Information Disclosure' tag in the input metadata is inconsistent with the CVSS C:N metric and the DoS-only description and should not factor into risk decisions. |
| Exploit ScenarioDerived | An attacker positioned on any network segment served by the vulnerable Windows DHCP Server - or routable to it via a DHCP relay agent - sends a specially crafted DHCP DISCOVER or REQUEST packet containing malformed option fields. The server's packet parser reads beyond the allocated option buffer, triggering an access violation that crashes the DHCP service and denies IP address assignment to all clients in the scope. No authentication or prior session state is required; the attack can be repeated to prevent service recovery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.
RemediationAI
Apply the Microsoft security update distributed through Windows Update and WSUS, targeting the specific build thresholds listed: Windows Server 2025 to 10.0.26100.33438 or later, Windows Server 2022 to 10.0.20348.5622 or later, Windows Server 2019 to 10.0.17763.9245 or later, Windows Server 2016 to 10.0.14393.9512 or later, Windows Server 2012 R2 to 6.3.9600.23397 or later, and Windows Server 2012 to 6.2.9200.26349 or later. Full details and update packages are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77502. Where immediate patching is not feasible, a compensating control is to restrict DHCP server exposure at the network level - use switch-layer DHCP snooping and ACLs to ensure only trusted client VLANs can reach the DHCP service port (UDP 67/68), reducing the attacker pool to internal or VLAN-adjacent hosts. Disabling the DHCP Server role entirely is not viable in most environments but temporarily migrating DHCP scope management to a patched host is a viable interim workaround for systems with prolonged patching cycles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-125 (Out-of-Bounds Read) within the Windows DHCP Server service (dhcpssvc.dll or related components). DHCP is a critical Layer 3 bootstrapping protocol; malformed client requests processed before session establishment are a classic attack surface because the service parses attacker-controlled packet data with no prior authentication. An out-of-bounds read at this layer can cause the server process to access memory beyond allocated buffer boundaries, leading to an exception that terminates service availability. Affected CPE strings span Windows Server 2012 through Windows Server 2025 as well as Windows 10 builds 1607 and 1809, indicating the vulnerable code path exists across a decade of Windows platform releases.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable DHCP service, unauthenticated packets trigger the flaw; only availability is impacted with no confidentiality or integrity effects.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Windows DHCP Server (CVE-2026-77502, CVSS 7.5) is vulnerable to a remote denial-of-service attack requiring only network access with no authentication, allowing attackers to crash the DHCP service. Exploitation would disable network connectivity for all clients served by affected DHCP infrastructure, potentially impacting business operations across the organization. Although active exploitation has not been confirmed, the ease of attack and broad deployment footprint create material operational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB