Windows DHCP Server EUVD-2026-73574

Exploitation requires the target Windows system to have the DHCP Server role explicitly installed and running - this is a non-default configuration absent from standard workstations and servers without the role deployed. The attacker must reach UDP port 67 on the DHCP server, either via the same local network segment or through a DHCP relay agent forwarding requests across routed segments. Per the CVSS vector (PR:N), no authentication credentials are required; any network-reachable host can send DHCP packets to trigger the read. Impact is strictly limited to information disclosure (C:H/I:N/A:N) with no confirmed code execution or availability disruption path. DHCP servers are typically internal infrastructure not exposed to the public internet, which substantially narrows the realistic attack population to internal or relay-proxied adversaries.

Microsoft's CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately captures the zero-authentication attack surface of the DHCP protocol, though real-world risk is tempered by deployment scope: only systems with the DHCP Server role explicitly installed are vulnerable, which excludes most Windows workstations and the large majority of servers without the role. DHCP traffic is normally constrained to local network segments, though DHCP relay agents can project the attack surface across routed environments. The confidentiality impact is rated High with no integrity or availability component, consistent with a read-only memory-disclosure primitive. EPSS at 0.77% (53rd percentile) reflects a low mass-exploitation probability, and the absence of both a CISA KEV listing and any public proof-of-concept further reduces urgency. This is best characterized as a moderate operational priority: DHCP servers should be patched promptly given the zero-authentication exposure, but this does not carry the same urgency as a code-execution primitive.

An attacker with access to the same network segment as a Windows DHCP Server - or with the ability to route packets through a DHCP relay agent - sends a specially crafted DHCP discover or request packet containing a malformed option or oversized length field. The DHCP Server's packet-parsing routine performs a read beyond the allocated buffer boundary (CWE-125), and the leaked memory contents are returned in the DHCP response or error reply. The disclosed data could include heap layout artifacts or other in-memory data useful for further attack chaining, though no public exploit or confirmed chaining technique has been identified.