Windows DHCP Server EUVD-2026-73586

The attacker must be on the same adjacent network segment (broadcast domain) as the Windows DHCP Server, or able to send DHCP messages via a relay agent - cross-routed remote exploitation is not possible given AV:A. The CVSS PR:L metric, consistent with the description's 'authorized attacker' language, indicates that completely anonymous unauthenticated access is insufficient; the attacker requires some authorized network presence (e.g., a domain-joined host, authenticated network port, or valid DHCP relay relationship). The Windows DHCP Server role must be actively installed and running on the target. No user interaction is required once the attacker has adjacency and authorization. Exploitation is further limited by: (1) impact is strictly availability - no credentials or data are exposed; (2) a service restart by an administrator restores availability without data loss.

The Medium CVSS 5.7 score (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the constrained attack surface: adjacency limits the attacker to the same broadcast domain, and PR:L (consistent with the description's 'authorized attacker' framing) means anonymous unauthenticated exploitation is not supported by the available data. The availability impact is High - a successful trigger crashes the DHCP service, potentially stranding all subnet clients unable to obtain or renew leases. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, so exploitation probability cannot be quantified; no public exploit code has been identified. Real-world priority is moderate: flat enterprise networks where partially-trusted or compromised domain-joined hosts share segments with DHCP servers are the primary exposure scenario. The presence of end-of-life Windows Server 2012 and 2012 R2 in the affected list is a notable concern for organizations on extended support.

An attacker who controls a low-privileged account or a compromised domain-joined host on the same subnet as the Windows DHCP Server sends a specially crafted DHCP request (e.g., a DHCPDISCOVER or DHCPREQUEST with a malformed option field) that triggers the out-of-bounds read, causing the DHCP Server service to crash. Clients on the segment are then unable to obtain or renew IP leases until an administrator restarts the service. No public exploit code has been identified.