CVE-2026-48564

What it actually does

CVE-2026-48564 is a heap-based buffer overflow in the Windows DHCP Server service. A low-privileged, authorized network attacker can send crafted network input to the DHCP Server component and corrupt heap memory in the service process. Successful exploitation can allow remote code execution in the security context of the DHCP Server service, potentially giving the attacker control over the affected server. Because DHCP servers are commonly infrastructure-critical and often run with elevated privileges, compromise can lead to full confidentiality, integrity, and availability impact.

Why it matters to the business

A successful attack could allow an attacker with limited authorized access to take control of a Windows server providing DHCP services. This can disrupt IP address assignment, cause network outages, alter DHCP behavior, support lateral movement, and expose sensitive infrastructure configuration. The issue affects multiple supported Windows Server generations and some Windows client versions where the DHCP Server role or component is present. Although it is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score, the CVSS 8.8 severity and network-reachable attack surface make timely remediation important for domain, branch, campus, and datacenter networks that depend on Windows DHCP.

How an attack unfolds

An attacker first obtains authorized low-privileged access to a network where the Windows DHCP Server service is reachable. The attacker identifies systems exposing DHCP Server functionality, typically on the local broadcast domain or routed DHCP relay paths. They then send specially crafted DHCP-related network traffic that triggers improper heap memory handling in the DHCP Server service. If the memory corruption is successfully shaped, the attacker can divert execution flow and run attacker-controlled code in the context of the service process. Post-exploitation activity may include persistence, credential access, modification of DHCP scopes or options, staging of additional tooling, disabling of logging, or lateral movement from the compromised infrastructure server.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-48564 for all affected Windows versions, including Windows Server 2012, 2016, 2019, 2022, 2025, and affected Windows 10 releases where applicable. No specific fixed build numbers were provided in the input, so administrators should use the relevant Microsoft Security Update Guide entry and Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch tooling to deploy the applicable cumulative updates. Prioritize systems running the DHCP Server role, systems reachable from untrusted or semi-trusted network segments, and DHCP servers handling routed relay traffic. Where immediate patching is not possible, restrict network access to DHCP services to required relay agents and trusted segments, block unnecessary inbound access to DHCP service ports, monitor for crashes or anomalous DHCP traffic, and ensure failover or backup DHCP capacity is available before maintenance. Do not rely on service restarts alone; restarting the DHCP Server service does not remove the vulnerable code path.

How to confirm the fix worked

Confirm that all affected Windows systems have the applicable Microsoft security update installed by checking Windows Update history, installed cumulative update KBs, vulnerability management scan results, or Microsoft Security Update Guide applicability data. Verify whether the DHCP Server role is installed and running on each system using Windows Server Manager, PowerShell, or service inventory. Confirm that DHCP service exposure is limited to expected network paths and that only authorized relay agents or client segments can reach it. After patching, validate that DHCP lease issuance, failover, reservations, and scope options operate normally. Run authenticated vulnerability scans or configuration checks to verify the CVE is no longer reported. Review service stability after patching and confirm there are no new DHCP Server service crashes or abnormal lease processing errors.

Typical attack path

1. Gain low-privileged authorized access to a network segment that can reach a Windows DHCP Server.
2. Discover DHCP services, relay paths, or Windows servers running the DHCP Server role.
3. Send crafted DHCP-related network traffic to the target service over the network.
4. Trigger the heap-based buffer overflow in the DHCP Server service.
5. Achieve code execution in the DHCP Server service process if exploitation succeeds.
6. Use the compromised server to disrupt DHCP operations, alter network configuration, collect credentials, or move laterally.

How to detect it

Look for evidence of attempted or successful exploitation in DHCP Server audit logs, Windows Event Logs, endpoint detection telemetry, crash dumps, and network records. Relevant log sources include Microsoft-Windows-DHCP Server event channels, DHCP audit logs under the DHCP system directory, Windows System logs for service termination, Windows Application logs for application crashes, Sysmon or EDR process telemetry, and network IDS/packet metadata for unusual DHCP traffic volume or malformed requests. Signs of exploitation may include unexpected DHCP Server service crashes, faulting module references involving the DHCP Server service DLL, repeated restarts of the DHCPServer service, abnormal UDP/67 traffic from a single authorized host or relay path, creation of crash dumps for svchost.exe hosting DHCPServer, unexpected child processes spawned by svchost.exe, changes to DHCP scopes/options/reservations without an approved change, or post-compromise behaviors such as credential dumping, new services, scheduled tasks, or unusual outbound connections from a DHCP server. No public exploit indicators or named threat actors were provided, so detection should focus on behavioral artifacts rather than fixed exploit strings.

• C:\Windows\System32\dhcp\DhcpSrvLog-*.log
• Microsoft-Windows-DHCP Server Events/Admin
• Microsoft-Windows-DHCP Server/Operational
• DHCPServer
• dhcpssvc.dll
• svchost.exe -k DHCPServer
• The DHCP Server service terminated unexpectedly
• Event ID 7031
• Event ID 7034
• Faulting application name: svchost.exe
• Faulting module name: dhcpssvc.dll
• C:\Windows\System32\dhcpssvc.dll
• UDP/67
• UDP/68
• C:\Windows\System32\dhcp\backup
• C:\Windows\System32\dhcp\j50.log
• C:\Windows\System32\dhcp\tmp.edb

What your security team should do

• Prioritize patching Windows servers running the DHCP Server role, especially those serving large network segments, routed relay traffic, or critical sites.
• Inventory all Windows systems with DHCP Server components enabled across Windows Server 2012, 2016, 2019, 2022, 2025, and affected Windows 10 versions.
• Use network controls to restrict DHCP service reachability to required client networks and approved DHCP relay agents.
• Increase monitoring of DHCP Server event logs, Windows Application/System logs, and endpoint telemetry for service crashes, suspicious child processes, or unexpected administrative changes.
• Review DHCP scopes, options, reservations, and failover configuration for unauthorized changes after any suspected exploitation.
• Ensure DHCP high availability, backups, and rollback plans are in place before patch deployment to reduce operational risk.
• Because the issue is not currently KEV-listed, has low EPSS, and has no known public exploit maturity, treat it as high-priority infrastructure patching rather than confirmed active exploitation unless local indicators suggest otherwise.