Windows DHCP Server EUVD-2026-73273

Exploitation requires an authorized local attacker (AV:L) with high-privilege access (PR:H) - specifically, the attacker must hold administrative rights on the target host running the Windows DHCP Server role. The DHCP Server role is a Windows Server feature not installed by default and must be explicitly enabled by an administrator. High attack complexity (AC:H) indicates specific preconditions must be met, most likely a particular heap or memory layout state, ruling out reliable automated exploitation. Remote unauthenticated exploitation is not possible per the CVSS vector. Windows 10 versions 1607 and 1809 appear in the affected list, but these SKUs do not natively support the DHCP Server role in standard configurations, and their inclusion should be verified against deployment reality. Exploitation is bounded to code execution within the local system context - no scope change (S:U) occurs.

The CVSS 6.4 score reflects the substantial exploitation constraints: local attack vector (AV:L), high attack complexity (AC:H), and high privilege requirement (PR:H) all significantly bound real-world applicability. An attacker must already hold administrative access on a host running the DHCP Server role and must satisfy specific conditions - likely a precise memory layout or timing requirement - to successfully trigger the OOB read and pivot to code execution. The CIA:H impact trio reflects successful code execution but overstates the realistic footprint given these prerequisites. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, nor is any public proof-of-concept known. This is a real but low-urgency patching item for most organizations: prioritize systems where DHCP Server role is externally accessible to lateral movement paths from less-trusted network segments. The presence of Windows 10 versions in the affected list alongside server SKUs is unusual and warrants verification against deployment context.

A Windows domain administrator with local interactive or remote desktop access to a Windows Server running the DHCP Server role supplies crafted DHCP configuration input or triggers a specific internal processing sequence in dhcpsrv.exe, causing the service to read memory beyond buffer bounds. With sufficient control over heap layout under the high-complexity attack conditions, the attacker converts the OOB read into code execution within the DHCP Server process. No public proof-of-concept is known at time of analysis.