EUVD-2026-99142
GHSA-h76g-4crr-hphx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DHCP service over network
-
DeliverySend crafted DHCP packet
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt service memory
-
ImpactExecute code on DHCP server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target Windows Server to have the DHCP Server role installed and running, with the attacker able to reach the DHCP service over the network (typically UDP 67). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. The primary limiting factor is deployment scope: only hosts actively configured as DHCP servers are affected - ordinary Windows clients and servers without the DHCP Server role are not exposed. Affected builds span Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10 1607/1809 below the listed patch levels. |
| Impact | Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely exploitable, low-complexity, unauthenticated flaw, and SSVC rates Technical Impact as 'total' - both consistent with a serious issue. However, SSVC also records Exploitation as 'none' and Automatable as 'no', and there is no EPSS score, no CISA KEV listing, and no public POC provided, so active exploitation is NOT established. Note a material internal conflict: the description states the attacker can 'execute code over a network' (implying full compromise), yet the supplied CVSS vector sets C:N/I:N/A:H (availability-only impact) for a 7.5 score. These are inconsistent - a true code-execution flaw would normally carry C:H/I:H - so the authoritative impact scope should be verified against the Microsoft MSRC advisory. Net: treat as a high-priority patch for any host running the Windows DHCP Server role given the unauthenticated network vector and memory-corruption class, but current data shows no evidence of in-the-wild exploitation. |
| Exploit ScenarioDerived | An attacker with network reachability to a Windows Server running the DHCP Server role sends a crafted DHCP message that triggers an out-of-bounds write in the service, corrupting memory to either crash the service or (per the description) execute code. No authentication or user interaction is required per the CVSS vector. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Memory corruption in the Microsoft Windows DHCP Server role allows unauthenticated remote attackers to execute arbitrary code on affected servers over the network. Only systems with the DHCP Server role installed and running are exposed - the attack surface is the DHCP service itself (typically UDP 67), while ordinary Windows clients and servers without that role are not vulnerable. Affected builds span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809 below the listed patch levels. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation and a non-automatable attack profile, although technical impact is rated total; a vendor patch is available. Note that the vendor-published base vector (7.5) reflects an availability-only impact, whereas the independent assessment scores confidentiality, integrity and availability all High (full code execution).
RemediationAI
Vendor-released patches are available: apply the Microsoft security update for CVE-2026-70058 from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70058) so that affected hosts reach at least the fixed build levels - 10.0.26100.33650 (Server 2025), 10.0.20348.5761 (Server 2022), 10.0.17763.9376 (Server 2019 / Windows 10 1809), 10.0.14393.9612 (Server 2016 / Windows 10 1607), 6.3.9600.23470 (Server 2012 R2) and 6.2.9200.26434 (Server 2012). Until patching completes, reduce exposure by ensuring DHCP traffic (UDP 67/68) is not reachable from untrusted or routed network segments - DHCP is a link-local protocol, so filtering it at perimeter and inter-VLAN boundaries blocks remote exploitation attempts, with the trade-off that legitimate DHCP relay agents and centrally managed scopes must be explicitly allow-listed or the relay chains repositioned. Where a server does not actually need to serve leases, remove or stop the DHCP Server role/service entirely (this is the highest-confidence mitigation, but clients depending on that scope will lose automatic addressing and require static configuration or an alternate DHCP server). If neither is feasible, isolate DHCP servers into a dedicated management VLAN with strict ACLs and monitor for anomalous or malformed DHCP option traffic as a compensating detective control; note that these network controls do not fix the underlying out-of-bounds write and should be treated as temporary. There is currently no public exploit code identified, so prioritization can follow normal patch cycles, but the SSVC 'Technical Impact: total' rating and the absence of authentication or user-interaction prerequisites argue for treating internet- or cross-segment-reachable DHCP servers as high priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds write (CWE-787) in Microsoft's Windows DHCP Server, the service that leases IP addresses and delivers DHCP options to clients on a network segment. Such flaws typically arise when processing a malformed DHCP packet or option field: a length or count value supplied by the sender is trusted without adequate bounds validation, and data is then written past the end of a fixed-size buffer or heap allocation. Because the memory corruption occurs inside a network-facing service listening on the DHCP port (conventionally UDP 67), successful exploitation can subvert control flow and lead to remote code execution in the context of the DHCP Server service. The vendor's own base vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) characterizes the flaw as a remote, unauthenticated denial-of-service/availability issue, while the independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) treats the out-of-bounds write as fully exploitable for code execution affecting confidentiality, integrity and availability - the memory-corruption class and the SSVC rating of 'Technical Impact: total' support the higher-impact reading. Both vectors agree that no privileges (PR:N) and no user interaction (UI:N) are required, so any host that can reach the DHCP service is a potential target. Exposure is bounded by deployment: the DHCP Server role must be installed and running, which limits the vulnerable population to infrastructure servers rather than the general Windows estate.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable DHCP service (AV:N/PR:N/UI:N); description states code execution, so C/I/A all High despite the input vector listing availability-only impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Organizations running the Microsoft Windows DHCP Server role on Windows Server 2012 through 2025, Windows 10 1607/1809, or Server Core face a high-severity risk to a core network service. Successful exploitation could disrupt network address assignment and compromise the server, affecting users and dependent systems. No public exploit identified at time of analysis, and a vendor patch is available, so leadership should prioritize remediation of affected DHCP infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB