Windows DHCP Server EUVD-2026-73701

The Windows DHCP Server role must be explicitly installed and running - this is not a default-enabled service on any affected platform. The attacker must be able to reach UDP port 67 on the target server, which is achievable by any host on the same network segment or via a DHCP relay agent without prior authentication (by protocol design). The CVSS AC:H metric indicates that beyond packet delivery, exploitation requires specific conditions - most likely precision exploitation of stack layout to overcome ASLR, stack canaries, or Control Flow Guard present on all affected Windows versions. No user interaction is required. Exploitation scope is limited to systems where the DHCP Server role has been intentionally deployed by an administrator; client-only Windows 10 installations would not be affected unless the DHCP Server role is somehow active.

The CVSS base score of 8.1 reflects the tension between the complete C/I/A impact from successful code execution and the high attack complexity (AC:H) that moderates exploitability. DHCP servers are core network infrastructure, reachable by any host seeking a lease - including untrusted devices on the same segment - making the network exposure structurally broad even within internal networks. AC:H is significant: stack overflows in network service parsers typically require bypass of modern mitigations such as ASLR, stack canaries, and Control Flow Guard, making reliable exploit development non-trivial. No public proof-of-concept code has been observed and no CISA KEV listing has been made, consistent with the AC:H rating. EPSS data was not provided in the input; without it, statistical exploitation probability cannot be assessed. Given the potential for SYSTEM-level compromise of a critical infrastructure service, organizations should treat this as a high-priority patching target, particularly for DHCP servers accessible from network segments containing untrusted hosts or DHCP relay paths.

An attacker with network access to a DHCP server - whether an insider, a compromised host on the same VLAN, or a host reachable via a DHCP relay agent - sends a specially crafted DHCP packet that overflows a stack buffer in the DHCP Server process. If the attacker successfully bypasses stack mitigations such as ASLR and stack canaries (consistent with the AC:H rating), execution redirects to attacker-controlled shellcode or a ROP chain, yielding SYSTEM-level code execution on the server. No public proof-of-concept exists at time of analysis, meaning this level of exploit development represents significant technical effort.