EUVD-2026-99873
GHSA-qjwj-fc28-8c92
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access to DHCP host
-
ExploitSubmit malformed input to DHCP Server service
-
ImpactTrigger out-of-bounds read and service crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running the Windows DHCP Server role (not enabled by default on most member servers, typically only on designated infrastructure servers), plus local access with valid low-privilege credentials (PR:L) on that host - this is not remotely reachable over the network (AV:L). The attacker-supplied malformed input must reach the DHCP service's vulnerable parsing path to trigger the CWE-125 out-of-bounds read. Limiting factors that reduce real-world risk: the DHCP Server role must be installed and running, the attacker must already have authenticated local access, no user interaction is needed but the only outcome is a service crash (availability), with no path to code execution or data disclosure. |
| Impact | All signals converge on this being a genuine but low-urgency issue, not a top priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, low-privilege, availability-only out-of-bounds read - there is no confidentiality or integrity impact despite the 'Information Disclosure' tag. CISA's SSVC decision framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified, so exploitation status is 'no public exploit identified at time of analysis.' One minor tension worth noting: SSVC rates Technical Impact as 'partial' while the CVSS sets A:H (total availability loss of the DHCP service) - these are not contradictory because SSVC 'partial' reflects impact to the overall system/host, not just the one service, and the host remains otherwise functional. Net: a patch-in-normal-cycle item, not an emergency. |
| Exploit ScenarioDerived | A low-privileged but authenticated local user on a Windows Server running the DHCP Server role supplies malformed input that the DHCP service parses, triggering an out-of-bounds read that crashes the service and denies DHCP leasing to the network. No public exploit code was identified, and the attack requires prior local access with valid low-level privileges, so this is a plausible insider or post-foothold nuisance rather than a remote mass-exploitation vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local denial of service in Windows DHCP Server (CVE-2026-70201) allows an authenticated attacker holding valid low-privilege credentials on a host running the DHCP Server role to crash the service by supplying malformed input that triggers an out-of-bounds read (CWE-125). Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) the issue is not remotely reachable and yields only availability impact, with no confidentiality or integrity loss and no code execution path. No public exploit identified at time of analysis: CISA SSVC records exploitation as 'none', automatable as 'no', technical impact as 'partial', and the CVE is not KEV-listed; Microsoft has shipped vendor patches, so urgency is low and the main prerequisite is that the DHCP Server role be installed and running (it is not enabled by default on typical member servers).
RemediationAI
Apply the Microsoft security update for this CVE per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70201, which raises affected systems to Windows Server 2025 10.0.26100.33650, Windows Server 2022 10.0.20348.5761, Windows Server 2019 10.0.17763.9376, Windows Server 2016 10.0.14393.9612, Windows Server 2012 R2 6.3.9600.23470, or Windows Server 2012 6.2.9200.26434 (or later) as applicable. Where patching must be staged, the strongest compensating control is attack-surface reduction: if the DHCP Server role is not required on a given host, uninstall or stop and disable the DHCP Server service, accepting that any local DHCP functions it provided will cease. Because the assessed vector is local with low privileges, restrict interactive, RDP, and other local logon rights to DHCP infrastructure servers using the principle of least privilege, which lowers the number of principals able to reach the vulnerable parsing path but does not eliminate the flaw for authorized administrators. Monitor the System and DHCP Server event logs for service crash/restart events that could indicate attempted trigger of this out-of-bounds read, and note that network-based filtering or DHCP snooping will not address this local vector since the attack does not traverse the network perimeter.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Windows DHCP Server role, the service that leases IPv4/IPv6 addresses and configuration options to clients. The root cause is an out-of-bounds read (CWE-125), meaning the service's parsing logic reads past the end of an allocated buffer when processing attacker-influenced input; unlike a write primitive, an OOB read cannot corrupt adjacent memory, so the realistic outcome is a crash of the DHCP service rather than memory corruption or code execution. Although DHCP is conventionally a UDP network protocol, the published and independently assessed vector is local (AV:L) with low privileges (PR:L), so the vulnerable parsing path is considered reachable through locally accessible interfaces of the DHCP service on the host rather than over the network from an unauthenticated remote sender; exploitation therefore requires the DHCP Server role to be present, the service running, and the attacker to already hold authenticated local access. EUVD tracks this as EUVD-2026-99873 and lists affected Windows Server builds, and Microsoft's MSRC update guide is the authoritative advisory; SSVC scoring confirms neither exploitation nor automation pressure at this time.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local authenticated low-priv user triggers the OOB read (AV:L, PR:L, AC:L); only the DHCP service crashes, so C:N/I:N and A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB