Windows DHCP Client EUVD-2026-73626

Exploitation requires the attacker to be on the same adjacent network (LAN, VLAN, or broadcast domain) as the target host; remote internet-based exploitation is not possible per AV:A. The Windows DHCP Client service must be running and the host must be configured to use DHCP (the default for virtually all Windows endpoints). No authentication, user interaction, or privileged access is required. Limiting factors include the adjacent-network constraint (LAN presence required), impact restricted to availability only (no data theft or code execution), and the vulnerability affecting only Windows 11 and Server 2025 builds below the fixed thresholds.

The CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 6.5 (Medium), which is consistent with the attack characteristics: no privileges, no user interaction, low complexity, but constrained to adjacent-network reach (attacker must be on the same LAN or broadcast domain). EPSS data is not provided, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. The real-world risk is moderate: Windows 11 and Server 2025 are widely deployed, and the DHCP client is enabled by default on virtually every Windows endpoint, meaning the attack surface within a LAN is broad. However, the adjacent-network constraint limits exposure - the attacker cannot exploit this remotely over the internet without first gaining LAN presence. A DoS against DHCP client causes network disruption on the affected host but does not yield code execution or data access. The CVSS score of 6.5 is appropriate and not inflated.

An attacker connected to the same LAN segment as an unpatched Windows 11 workstation sends a stream of crafted DHCP response packets designed to trigger repeated memory allocations in the DHCP client. Because allocated buffers are never freed, heap memory is progressively exhausted until the DHCP client service becomes unresponsive, causing the affected host to lose the ability to obtain or renew network leases and degrading system stability. No exploit code has been publicly identified and no user interaction is required beyond the DHCP client being active.