CVE-2026-45634

What it actually does

This vulnerability is an out-of-bounds read in the Windows DHCP Server component. A low-privileged, authorized local attacker can trigger the flaw and cause the DHCP Server process or related component to read memory outside the intended buffer. The primary impact is confidentiality: memory contents may be disclosed to the attacker. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no direct integrity or availability impact.

Why it matters to the business

Successful exploitation could expose sensitive information present in process memory, which may include configuration data, service state, network-related information, or material useful for follow-on privilege escalation or lateral movement. Because exploitation requires local authorized access and there is no current KEV listing, ransomware association, or known exploit maturity, the immediate internet-scale risk is lower than for remotely exploitable DHCP flaws. However, DHCP servers are operationally important infrastructure, and disclosure of server-side information can still increase the impact of a compromised low-privileged account.

How an attack unfolds

An attacker first obtains low-privileged local access to a Windows system with the affected DHCP Server component installed or reachable through local service interfaces. The attacker then invokes the vulnerable DHCP Server code path using crafted local input, service interaction, or configuration/API activity that causes the component to read past the bounds of an expected memory buffer. If exploitation succeeds, the attacker receives or infers memory contents that should not have been exposed. The disclosed information may then be used to understand service internals, identify sensitive configuration values, or support additional attacks. There is no indication from the provided data that this vulnerability is currently exploited in the wild or used by named threat actors.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems that include or run the DHCP Server component. No exact fixed build numbers were provided, so remediation should be validated against Microsoft’s official update guidance for CVE-2026-45634 and the applicable monthly cumulative update. Where immediate patching is not possible, reduce risk by limiting local interactive access to DHCP servers, restricting administrative and remote logon rights, removing the DHCP Server role from systems that do not require it, and monitoring for unusual local interaction with DHCP management tools or services.

How to confirm the fix worked

Confirm that each affected Windows host has installed the Microsoft security update that addresses this vulnerability. Validate operating system build and patch level using enterprise patch management, Windows Update history, or PowerShell inventory. On servers, verify whether the DHCP Server role is installed and prioritize those systems for remediation. Confirm that the DHCP Server service remains healthy after patching and that DHCP lease issuance, failover, reservations, and scope configuration continue to operate as expected. For exposure validation, identify unpatched systems where the DHCP Server role is enabled or where affected DHCP Server binaries are present.

Typical attack path

1. Gain authorized local access to an affected Windows host, typically through a low-privileged account.
2. Identify that the DHCP Server component or affected Windows build is present and unpatched.
3. Interact with the vulnerable local DHCP Server code path using crafted input or local service calls.
4. Trigger the out-of-bounds read condition.
5. Collect disclosed memory contents or error output that reveals unintended information.
6. Use the disclosed information to support further reconnaissance, privilege escalation research, or movement within the environment.

How to detect it

There may be no definitive artifact of exploitation because an out-of-bounds read can disclose memory without crashing the service or writing obvious files. To assess possible prior exploitation, review Windows Security logs for unexpected local or remote interactive logons to DHCP servers, especially by low-privileged accounts. Review DHCP Server Admin and Operational event logs for unusual management activity, service restarts, errors, or malformed requests around suspicious logon times. Review PowerShell, Sysmon, EDR, and process creation telemetry for unusual execution of DHCP management utilities, custom binaries, scripts, or service-control commands by non-administrative users. Investigate DHCP Server process crashes, access violations, or Windows Error Reporting events, although the vulnerability’s stated impact is information disclosure rather than denial of service. Correlate any suspicious local account activity with patch status to determine whether an attacker had an opportunity to trigger the vulnerable code path before remediation.

What your security team should do

• Prioritize patching Windows systems that run the DHCP Server role, especially domain-joined infrastructure servers and systems accessible by many administrators or operators.
• Inventory affected Windows client and server versions and identify where the DHCP Server component is installed or enabled.
• Restrict local logon, RDP, PowerShell remoting, and service-management permissions on DHCP servers to the smallest necessary administrator group.
• Review recent low-privileged local logons to DHCP servers and investigate unusual service interaction, scripting, or DHCP management activity.
• Monitor Microsoft security advisories for fixed build details, exploitation updates, or changes in exploit maturity.
• Because EPSS is low and the vulnerability is not listed in KEV, handle through normal vulnerability management unless sensitive DHCP infrastructure or prior compromise indicators increase local risk.