CVE-2026-45608

What it actually does

This vulnerability is an out-of-bounds read in the Windows DHCP Server component. A local attacker can cause the DHCP Server process to read memory outside the intended buffer boundary, potentially exposing process memory and causing the service to terminate or become unstable. The CVSS vector indicates local exploitation, low attack complexity, no user interaction, limited confidentiality impact, and high availability impact, meaning service disruption is the more significant technical risk than data theft.

Why it matters to the business

Successful exploitation can disrupt DHCP services on affected Windows systems, which may prevent endpoints from obtaining or renewing IP addresses and cause network connectivity issues. Information exposure may also reveal sensitive process memory that could assist further local compromise. Because DHCP is often foundational to network availability, outages can affect workstation onboarding, server connectivity, branch operations, and incident response workflows. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity, so urgency is moderate unless the affected system runs a critical DHCP service or permits broad local access.

How an attack unfolds

An attacker first obtains local access to an affected Windows system where the DHCP Server component is installed or active. The attacker then triggers the vulnerable code path through a crafted local interaction with the DHCP Server component, causing the service to perform an out-of-bounds memory read. Depending on memory layout and runtime conditions, this can disclose adjacent process memory and may destabilize or crash the DHCP Server service. In practical terms, the attacker would likely use the flaw to gather memory contents for follow-on activity or to cause a denial of service against DHCP-dependent network operations.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including supported Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems. Where the DHCP Server role is not required, remove or disable it. Restrict local logon rights and administrative access to systems running DHCP services, and monitor for unauthorized local execution. Ensure DHCP services run only on designated servers, and use network segmentation and administrative tiering to reduce the likelihood that a local compromise reaches DHCP infrastructure. If patching must be delayed, prioritize compensating controls that limit local access, remove unnecessary DHCP Server installations, and ensure rapid service recovery procedures are in place.

How to confirm the fix worked

Confirm that affected systems have installed the relevant Microsoft cumulative security update released for this issue or a later superseding update. Use enterprise patch tooling, Windows Update, WSUS, Microsoft Configuration Manager, or vulnerability scanners to verify patch status across all affected Windows versions. On individual systems, review installed updates with tools such as Get-HotFix or Windows Update history, and confirm the DHCP Server component files are at patched versions according to Microsoft’s advisory. Validate exposure by inventorying systems where the DHCP Server role or service is present and confirming whether the DHCP Server service is running. After remediation, restart the service or system if required by the update, then verify DHCP lease issuance and renewal still function normally.

Typical attack path

1. Identify a Windows system running an affected version of the DHCP Server component.
2. Obtain local access to the system through valid credentials, prior compromise, or local execution capability.
3. Trigger the vulnerable DHCP Server code path using crafted local input or interaction.
4. Cause the DHCP Server process to read memory outside the expected buffer boundary.
5. Collect any exposed memory contents if available and use them for follow-on reconnaissance or privilege-escalation attempts.
6. Optionally repeat the trigger to crash or destabilize the DHCP Server service, causing DHCP availability issues.

How to detect it

There is unlikely to be a definitive log entry proving exploitation because out-of-bounds reads often do not produce application-level audit records. Focus detection on indirect evidence: unexpected DHCP Server crashes or restarts, Windows Error Reporting events, crash dumps involving the DHCP Server service, local logons immediately preceding service instability, unusual command execution by local users on DHCP servers, and repeated service control activity. Review Windows System logs for Service Control Manager events indicating the DHCP Server service terminated unexpectedly, Application logs for application crashes involving svchost.exe or DHCP Server-related modules, Windows Error Reporting records, and Microsoft-Windows-DHCP-Server operational logs for abnormal service failures. If endpoint telemetry is available, correlate suspicious local processes, script interpreters, or unknown binaries executed by interactive users with DHCP Server crashes or memory dump creation. Treat memory dumps generated around the crash time as sensitive artifacts because they may contain the data an attacker attempted to disclose.

• Service Control Manager event ID 7031: DHCP Server service terminated unexpectedly
• Service Control Manager event ID 7034: DHCP Server service terminated unexpectedly
• Application Error event ID 1000: svchost.exe
• Windows Error Reporting event ID 1001: svchost.exe
• Microsoft-Windows-DHCP-Server/Operational
• DHCPServer
• DHCP Server
• dhcpssvc.dll
• svchost.exe -k DHCPServer
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• C:\Windows\System32\dhcpssvc.dll

What your security team should do

• Prioritize patching Windows systems that run the DHCP Server role, especially domain infrastructure, branch DHCP servers, and high-availability DHCP clusters.
• Inventory all affected Windows client and server versions to identify where the DHCP Server component is installed, even if not intentionally used.
• Disable or remove the DHCP Server role from systems that do not require it.
• Restrict local logon and code execution capability on DHCP servers to trusted administrators only.
• Monitor for DHCP Server service crashes, unexpected restarts, Windows Error Reporting artifacts, and suspicious local activity near the time of service instability.
• Review resilience plans for DHCP, including failover pairs, backup configurations, and documented service recovery procedures.
• Because public exploitation is not currently reported and EPSS is low, handle through the normal security update cycle unless the system provides critical DHCP services or has elevated local access risk.