Windows DHCP Server EUVD-2026-73423

The Windows DHCP Server role must be installed and running on the target system - this role is not enabled by default on standard Windows Server installations and must be explicitly configured. Network access to UDP port 67 on the target is required. The CVSS vector lists UI:R, though for an autonomous server daemon this is operationally equivalent to UI:N since no deliberate server-side user action is needed; a DHCP client initiating an exchange constitutes the nominal 'interaction'. No authentication is required (PR:N). Exploitation is limited to systems actively serving DHCP; Windows endpoints that have the DHCP client role but not the server role are not affected.

The CVSS 8.8 base score reflects a network-reachable, low-complexity attack requiring no privileges, with full confidentiality, integrity, and availability impact - a serious signal on its own. However, the assigned UI:R metric warrants scrutiny: the Windows DHCP Server is a network daemon that autonomously processes UDP datagrams without server-side user interaction, and UI:R is atypical for this attack class. If UI:R was assigned because a DHCP client must initiate the exchange, that 'interaction' is OS-automated and effectively indistinguishable from UI:N in practice, making the real-world attack bar closer to a CVSS 9.8 network-unauthenticated scenario. No EPSS score was provided and the entry does not appear in CISA KEV, suggesting exploitation has not been observed in the wild as of this analysis. Nevertheless, DHCP servers are typically perimeter-adjacent or internal-network-exposed, and even a mid-sized municipal IT team in koszalin operating standard Windows infrastructure should treat this as an urgent patching priority given the broad version spread and high theoretical exploit reliability of integer-overflow-to-buffer-overflow chains in network daemons. The absence of a known POC is a mitigating factor, but the attack surface - an always-listening, unauthenticated UDP service - is highly automatable.

An attacker on the same network segment (or any network with routed access to UDP/67) sends a crafted DHCP DISCOVER or REQUEST packet containing field values engineered to trigger the integer overflow, causing an undersized heap allocation. A subsequent write into the overflowed buffer corrupts allocator metadata or a function pointer, redirecting execution to attacker-controlled code running as NETWORK SERVICE or SYSTEM on the DHCP server. No authentication or prior foothold is required. No public POC exists at time of analysis.