Windows DHCP Server EUVD-2026-73284

The Windows DHCP Server role must be installed and actively running on a supported-but-unpatched Windows Server or Windows 10 host. Since DHCP operates on UDP port 67 without any authentication (per protocol design), no credentials or special permissions are required - any attacker with network-layer reachability to the DHCP server can trigger the flaw. Exploitation is not limited to the local subnet if DHCP relay agents (e.g., ip helper-address on routers) are configured, as relay agents forward client requests across subnets, expanding the attack surface. DHCP broadcast traffic is normally blocked at Layer 3 boundaries, which limits direct internet exposure for servers not configured with a relay; organizations without relay agents are exposed only from directly connected subnets. No user interaction is required on the server.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) accurately characterizes the threat: DHCP is a trust-less protocol by design, so no authentication is required, and the low complexity means exploitation requires only a crafted DHCP packet. Real-world impact is significant in enterprise environments where loss of the DHCP service causes immediate and widespread client connectivity failure. No EPSS data was provided; without KEV listing or public exploit code, opportunistic mass exploitation is not currently confirmed, but the zero-prerequisite network attack surface means the vulnerability is trivially automatable once any exploit primitive becomes public. The 'Information Disclosure' tag in the input data conflicts with CVSS C:N and should be treated as a mislabel. The 'Buffer Overflow' tag is also an imprecise characterization - CWE-125 is an out-of-bounds read, not a write primitive, which reduces exploitation potential beyond DoS.

An attacker on the same network segment - or any network with a DHCP relay agent forwarding to the server - sends a specially crafted malformed DHCP discovery or request packet to UDP port 67 of the Windows DHCP Server. The server's packet-parsing code reads beyond the allocated buffer boundary, triggering an access violation that crashes the DHCP service. All network clients dependent on that DHCP server immediately lose the ability to obtain or renew IP leases, causing widespread network connectivity disruption until the service is restarted or patched. No public exploit code has been identified at time of analysis.