# CVE-2026-102720: NetX DHCP client buffer over-read in option parsing

Source: https://junglewise.ai/threats/cve-2026-102720-a-dhcp-server-or-anyone-on-the-lan-who-answers-a-discover-first  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102720 · Severity: info · Published 2026-09-29

A DHCP client in NetX can be tricked into reading memory beyond the end of a DHCP message when processing specially crafted DHCP OFFER packets from a server or attacker on the local network. This buffer over-read exposes uninitialized or adjacent memory contents that can be observed through network configuration, potentially leaking sensitive information during system boot.

Technologies: [Microsoft NetX](https://junglewise.ai/threats/technologies/netx). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-102720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102720 being exploited in the wild.

**How severe is CVE-2026-102720?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Microsoft NetX Unknown.

**Is there a fix for CVE-2026-102720?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102720 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-102720?** Check whether you run Microsoft NetX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an off-by-one error in the DHCP option parsing loop (nxd_dhcp_client.c) where a pointer and counter are maintained separately but advance by different amounts. For each skipped option, the data pointer advances by size+2 bytes while the bound-check counter only advances by size+1, causing the pointer to drift past the message boundary while the loop condition still evaluates as true. This leads to heap-buffer-overflow reads when parsing a DHCP OFFER with a long chain of skippable options, occurring during client initialization before network configuration is complete.

## Affected products

- Microsoft NetX Unknown

## Timeline

- 2026-09-29: disclosed

## Related threats

- [NetX RTSP server packet pool exhaustion in Session header parsing](https://junglewise.ai/threats/cve-2026-102716-an-unauthenticated-client-can-drain-the-rtsp-server-s-packet)
- [NetX ICMPv6 option parsing buffer over-read and denial of service](https://junglewise.ai/threats/cve-2026-102714-nx-icmpv6-validate-options-scans-the-option-area-with-while)
- [NetX TFTP server heap buffer overflow in DATA handler](https://junglewise.ai/threats/cve-2026-102713-the-tftp-server-accepts-a-data-datagram-of-any-size-the)