Executive brief
A security vulnerability exists in the Windows DHCP Server, a core component used to automatically assign IP addresses to devices on a network. An authorized user on the same local network could exploit this flaw to gain higher-level administrative privileges on the server. This could allow an attacker to take control of the server, potentially leading to data theft or disruption of network services.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Microsoft Windows DHCP Server service. The vulnerability is triggered when the server improperly handles specially crafted DHCP packets. An attacker must be authenticated and located on an adjacent network (the same local subnet) to exploit the flaw. Successful exploitation allows for local privilege escalation, potentially leading to full system compromise. Microsoft has released security updates for affected versions of Windows 10 and Windows Server (2012 through 2019).
Affected products
- Microsoft Windows 10 Version 1607 < 10.0.14393.9339
- Microsoft Windows 10 Version 1809 < 10.0.17763.9020
- Microsoft Windows Server 2012 / 2012 R2 6.2.9200.26226 / 6.3.9600.23291
- Microsoft Windows Server 2016 / 2019 10.0.14393.9339 / 10.0.17763.9020
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory