CVE-2026-44815

What it actually does

This is a network-exploitable stack-based buffer overflow in the Windows DHCP Client. A malformed DHCP message can overwrite memory in the client-side DHCP handling path, potentially allowing unauthenticated remote code execution in the context of the Windows DHCP Client service process. Because exploitation requires no credentials or user interaction and can affect both workstation and server versions, successful exploitation could compromise confidentiality, integrity, and availability of the impacted system.

Why it matters to the business

Compromise of Windows clients or servers through DHCP traffic could allow an attacker on a local network segment, a rogue DHCP server, or an attacker able to intercept DHCP traffic to take control of systems without user involvement. This can lead to malware deployment, lateral movement, data theft, endpoint outages, or disruption of network-dependent business operations. Although this vulnerability is not currently listed in CISA KEV and has low reported EPSS, the CVSS severity is critical and the affected Windows footprint is broad, so remediation should be prioritized for exposed enterprise endpoints and servers.

How an attack unfolds

An attacker positions themselves where they can send DHCP traffic to a vulnerable Windows system, most commonly on the same broadcast domain, through a rogue DHCP server, compromised network device, malicious Wi-Fi network, or DHCP relay path. The attacker sends a specially crafted DHCP response or related DHCP packet that is processed by the Windows DHCP Client. The malformed data triggers a stack-based buffer overflow in the DHCP client code. If the attacker controls memory layout reliably, the overflow can redirect execution flow and run attacker-supplied code within the DHCP Client service process. Post-exploitation activity may include establishing persistence, disabling security tooling, credential access, lateral movement, or installing malware. No public exploit maturity is currently reported in the supplied data, so defenders should focus on patching and monitoring for suspicious DHCP behavior, rogue DHCP services, and DHCP Client crashes.

How to fix it

Apply the Microsoft security update or latest cumulative update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025 releases listed as affected. Because no exact fixed build numbers were supplied, use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the applicable cumulative update for each supported OS version. Prioritize systems on untrusted networks, shared LANs, Wi-Fi networks, branch networks, VDI pools, and servers that rely on DHCP. As compensating controls, enable DHCP snooping and trusted DHCP server enforcement on switches, block unauthorized DHCP servers, segment untrusted networks, monitor DHCP relay configurations, and restrict client exposure to unmanaged broadcast domains. Do not disable the DHCP Client service unless systems are explicitly configured with static addressing and the operational impact is understood.

How to confirm the fix worked

Confirm that each affected Windows asset has installed the applicable cumulative security update released by Microsoft for this vulnerability. Validate via Windows Update compliance reports, WSUS/SCCM/Intune patch status, vulnerability scanner checks, or local commands such as querying installed hotfixes and OS build information. Confirm that Windows 10, Windows 11, and Windows Server systems are on a supported and patched build. Test representative systems by verifying normal DHCP lease acquisition and renewal after patching. From the network side, verify that DHCP snooping or equivalent controls only permit authorized DHCP servers and that unauthorized DHCP offers are blocked or alerted. Re-run authenticated vulnerability scans after patch deployment to confirm the exposure is cleared.

Typical attack path

1. Gain the ability to send DHCP traffic to target Windows systems, such as by joining the same LAN, operating a rogue DHCP server, compromising a network device, or abusing DHCP relay paths.
2. Wait for or force DHCP client activity, such as lease discovery, renewal, network reconnection, or interface enablement.
3. Send a malformed DHCP packet crafted to trigger the stack-based buffer overflow in the Windows DHCP Client.
4. Achieve code execution in the DHCP Client service process if exploit reliability and memory control are successful.
5. Use the compromised host for persistence, credential theft, lateral movement, malware staging, or disruption of endpoint/network services.

How to detect it

To determine whether this may have already been exploited, review endpoint and network telemetry for signs of malformed or unauthorized DHCP activity followed by Windows DHCP Client instability or suspicious post-exploitation behavior. Relevant sources include Windows System and Application event logs, Windows Error Reporting, EDR process telemetry, Sysmon logs, DHCP server logs, switch DHCP snooping logs, NAC logs, wireless controller logs, firewall or NDR packet metadata, and packet captures from affected segments. Look for DHCP offers, acknowledgements, or options from unauthorized DHCP servers; repeated DHCP lease failures; crashes of svchost.exe hosting the DHCP Client service; faults involving dhcpcsvc.dll or DHCP-related components; and Service Control Manager events showing the DHCP Client service terminating unexpectedly. Correlate any DHCP Client crash with subsequent unusual child processes, credential dumping tools, persistence changes, outbound command-and-control traffic, or lateral movement. Because no public exploit maturity or known threat actor activity is provided, absence of these artifacts does not prove non-exploitation; prioritize correlation of network DHCP anomalies with endpoint crash and EDR telemetry.

• dhcpcsvc.dll
• DHCP Client service terminated unexpectedly
• The DHCP Client service terminated unexpectedly
• svchost.exe -k LocalServiceNetworkRestricted
• svchost.exe -k LocalServiceNetworkRestricted -p
• Faulting application name: svchost.exe
• Faulting module name: dhcpcsvc.dll
• Event ID 1000
• Event ID 1001
• Event ID 7031
• UDP/67
• UDP/68
• DHCP Offer from unauthorized server
• DHCP ACK from unauthorized server
• rogue DHCP server
• DHCPNAK
• DHCPREQUEST
• DHCPOFFER
• DHCPACK

What your security team should do

• Prioritize patch deployment for affected Windows endpoints and servers on shared, wireless, branch, lab, guest-adjacent, or otherwise less-trusted network segments.
• Use centralized patch tooling to identify all affected Windows 10, Windows 11, and Windows Server versions and deploy the latest applicable cumulative updates.
• Enable or verify DHCP snooping, trusted DHCP server enforcement, and rogue DHCP detection on enterprise switches and wireless infrastructure.
• Hunt for DHCP Client service crashes, unexpected svchost.exe faults involving DHCP components, and unusual DHCP traffic from unauthorized servers around the publication date and onward.
• Review network access control and segmentation to limit an attacker’s ability to send DHCP responses to managed Windows systems.
• Monitor Microsoft advisories and threat intelligence for any change in exploit maturity, KEV status, ransomware usage, or published proof-of-concept code.
• Treat unexplained DHCP Client crashes followed by suspicious process creation, credential access, or lateral movement as a potential compromise requiring incident response.