Executive brief
Windows DHCP Server is a critical network service that assigns IP addresses to devices on corporate networks. A type confusion vulnerability allows an unauthenticated attacker to crash the DHCP service over the network, preventing legitimate devices from obtaining IP addresses and disrupting network operations.
Technical details
A type confusion vulnerability exists in Windows DHCP Server where resources are accessed using incompatible types, violating memory safety assumptions. The vulnerability is triggered over the network without requiring authentication or user interaction. An attacker can send specially crafted DHCP protocol packets to cause a denial of service by crashing the DHCP Server process. The attack vector is network-based and reaches any system running the vulnerable DHCP Server component.
Affected products
- Microsoft Windows DHCP Server <UNKNOWN>
Timeline
- 2026-09-08: disclosed