Executive brief
Windows DHCP Server is a critical networking service that assigns IP addresses to devices on a network. A memory leak vulnerability allows an authorized attacker on the same network to repeatedly trigger memory exhaustion, causing the DHCP service to become unavailable and preventing new devices from obtaining network configuration. This can disrupt network operations and device connectivity.
Technical details
The vulnerability is a CWE-401 (missing release of memory after effective lifetime) in Windows DHCP Server. An authorized attacker on an adjacent network can send specially crafted requests that trigger memory allocation without proper cleanup, leading to memory exhaustion. This is a resource exhaustion vulnerability requiring network adjacency and authentication. Successful exploitation results in denial of service of the DHCP service. Microsoft has released a security update to address this issue.
Affected products
- Microsoft Windows DHCP Server
Timeline
- 2026-09-08: disclosed