Windows DHCP Server EUVD-2026-99861

The target host must have the Windows DHCP Server role installed and running - this is not present on a default Windows Server or client OS, so the vulnerable attack surface exists only on provisioned DHCP servers. Exploitation requires local, authenticated access (PR:L) by an already-logged-on, low-privileged user; it is not remotely reachable over the network per the AV:L vector. The use-after-free is a timing/race condition (AC:H), so exploitation is non-deterministic and may require repeated attempts to hit the freed-memory window. No user interaction is required (UI:N). These factors - local access, a non-default server role, and a race-condition dependency - collectively limit realistic exploitation to a post-compromise privilege-escalation step on DHCP infrastructure.

This is a moderate-priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires an attacker to already have local, authenticated access (PR:L) and to win a use-after-free race condition (AC:H), which raises the practical bar. All real-world exploitation signals point to low urgency: there is no CISA KEV listing, no public exploit identified at time of analysis, and the CISA SSVC decision framework explicitly records Exploitation: none and Automatable: no - meaning CISA sees no evidence of exploitation and the flaw cannot be reliably automated/mass-exploited. The one signal that elevates concern is SSVC Technical Impact: total, consistent with the C:H/I:H/A:H impact: successful exploitation yields full control of the DHCP Server host. The signals are internally consistent (local vector + authorized attacker + high complexity + total impact all align with a hands-on-keyboard EoP). No conflicting data is present; EPSS was not provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: treat as a routine-to-prioritized patch for Windows Servers running the DHCP role, especially on domain-attached infrastructure where SYSTEM on a DHCP host is a valuable lateral-movement foothold - but it is not a high-real-risk, wormable issue.

An attacker who already holds a low-privileged foothold on a Windows Server that has the DHCP Server role installed triggers a use-after-free in the DHCP Server service to corrupt memory and execute code in the service's SYSTEM context. Because the flaw is a race condition (AC:H), the attacker may need multiple attempts to reliably hit the freed-memory window. No public exploit code has been identified at time of analysis, so this would require original exploit development.