Windows DHCP Server EUVD-2026-73463

The Windows DHCP Server role must be explicitly installed and actively running on the target system - this role is not present in any default Windows Server installation and requires deliberate administrator configuration. Exploitation requires no authentication and no user interaction, consistent with CVSS PR:N/UI:N. The attacker must have network-layer access sufficient to deliver a UDP packet to port 67 on the DHCP server. Limiting factors: DHCP servers are typically on dedicated internal infrastructure rather than internet-exposed hosts; network segmentation commonly restricts UDP 67 access to internal relay agents; and the absence of public exploit code raises the bar for opportunistic attacks at time of analysis.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat: unauthenticated, low-complexity, network-accessible denial of service with no confidentiality or integrity dimension. EPSS data was not provided in the input, preventing probability-of-exploitation assessment. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, which moderates immediate operational urgency relative to the raw score. That said, DHCP service disruption has outsized operational impact - loss of DHCP causes rapid address-assignment failure across every client subnet served by the affected server, meaning even a mid-sized organization should treat patching as a near-term priority rather than a routine patch-cycle item. A notable complication is the inclusion of Windows Server 2012 and 2012 R2, both beyond mainstream extended support; patches for these versions suggest Microsoft is providing fixes under Extended Security Updates (ESU) programs, and organizations still running these releases face compounded lifecycle risk beyond this specific CVE.

An attacker with UDP reachability to a Windows DHCP server sends a specially crafted DHCP request that causes the service to read beyond an allocated buffer boundary, triggering an access violation and crashing the server process. Because DHCP is unauthenticated by protocol design, no credentials or prior session state are needed. No public exploit code exists at time of analysis, but the low-complexity unauthenticated network vector means a working trigger could be discovered through systematic fuzzing of DHCP request fields.