Windows DHCP Server EUVD-2026-99330

Exploitation requires the target host to be running the Windows DHCP Server role and the attacker to already possess local, authorized (low-privilege) access to that host - consistent with CVSS AV:L and PR:L. There is no user interaction requirement (UI:N) and attack complexity is low (AC:L), so once a foothold exists, triggering the heap overflow is reliable. Limiting factors: the attacker must first authenticate/obtain a local account, the vulnerable DHCP Server component must be installed and running (it is an optional server role, not present on default client installs), and systems patched to the fixed build numbers listed in Microsoft's advisory (e.g. Server 2025 >=10.0.26100.33650, Server 2019 >=10.0.17763.9376) are not affected.

Signals are largely consistent and point to a genuine but non-urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attack requiring low but non-zero privileges (PR:L = an authenticated/authorized attacker) with low complexity and no user interaction, yielding total impact (C:H/I:H/A:H) - hence the 7.8 base score. CISA's SSVC framework corroborates a non-emergency posture: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local, authentication-gated vector that cannot be sprayed at scale), while Technical Impact is 'total' (matching the full C/I/A compromise, i.e. escalation to SYSTEM on a successful heap overflow). No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is indicated, so there is no evidence of in-the-wild use. This is therefore a credible patch-in-normal-cycle priority rather than a drop-everything emergency: the total technical impact and low attack complexity make it attractive as a post-compromise escalation primitive, but the local vector plus required prior foothold substantially limit real-world risk. Note one minor gap: the description says 'authorized attacker' which is consistent with PR:L, but the exact privilege level that qualifies as 'authorized' is not spelled out by the vendor and should be verified against Microsoft's advisory.

An attacker who already has a low-privileged authenticated foothold on a Windows Server running the DHCP Server role sends specially crafted input to the DHCP service to trigger a heap-based buffer overflow, corrupting memory to execute arbitrary code at SYSTEM privilege. No user interaction is required and attack complexity is low, but local/authorized access is a prerequisite. No public exploit code has been identified at time of analysis.