CVE-2026-50370

What it actually does

This is a heap-based buffer overflow in the Windows DHCP Server service. An unauthenticated attacker on an adjacent network can send specially crafted DHCP traffic to a vulnerable DHCP server and corrupt heap memory in the service process. Successful exploitation can result in arbitrary code execution in the security context of the DHCP Server service, with potential full compromise of the host depending on service privileges and post-exploitation actions. The CVSS vector indicates adjacent-network reachability, low attack complexity, no authentication, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised DHCP server can disrupt IP address assignment, causing network outages for clients that rely on it, and may give an attacker a foothold on a critical infrastructure server. Because DHCP servers often sit on sensitive network segments and are trusted by many endpoints, successful exploitation could enable lateral movement, credential theft, service disruption, or manipulation of network configuration. The vulnerability is not currently listed in CISA KEV, has no reported exploit maturity, and has a low EPSS score, but the impact is high enough that externally or broadly reachable DHCP services should be prioritized for patching.

How an attack unfolds

An attacker must be able to send DHCP traffic to the vulnerable Windows DHCP Server from the same broadcast domain, relay path, or otherwise adjacent network position. The attacker crafts malformed DHCP packets that trigger unsafe heap handling in the DHCP Server service. When processed, the packets cause a heap buffer overflow, potentially allowing the attacker to redirect execution flow and run attacker-controlled code within the DHCP service process. If exploitation succeeds, the attacker can execute commands, deploy tools, disable or disrupt DHCP service, collect credentials or configuration data from the server, and attempt lateral movement to other systems reachable from the DHCP server.

How to fix it

Apply the relevant Microsoft security update for all affected Windows and Windows Server versions, including Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. If a DHCP server cannot be patched immediately, restrict DHCP traffic to trusted network segments, block unauthorized access to UDP/67 and UDP/68 where feasible, disable the DHCP Server role on systems that do not require it, and ensure DHCP relay agents only forward traffic from expected networks. Use network segmentation and ACLs to prevent untrusted adjacent systems from reaching DHCP infrastructure. Because no fixed version list was provided, use Microsoft’s official update catalog and security update guidance for this vulnerability to identify the exact monthly cumulative update applicable to each OS build.

How to confirm the fix worked

Confirm that each affected Windows or Windows Server host has the Microsoft security update containing the fix installed. Validate the OS build number and installed cumulative update level using Windows Update history, PowerShell, endpoint management tooling, or vulnerability scanners. Confirm that the DHCP Server role is not installed or running on systems where it is not required. Test network controls by verifying that only authorized DHCP clients, relay agents, and trusted segments can reach the DHCP server on UDP/67. Run authenticated vulnerability scans or configuration checks after patching to verify the CVE no longer appears as exposed.

Typical attack path

1. Gain access to an adjacent network segment or a network path that can deliver DHCP traffic to the target DHCP server.
2. Identify Windows DHCP Server instances by observing DHCP replies, scanning for UDP/67 exposure, or reviewing network behavior.
3. Send specially crafted DHCP requests or related DHCP messages designed to trigger the heap overflow.
4. Achieve code execution in the DHCP Server service process if memory corruption is successfully controlled.
5. Establish persistence or execute follow-on commands on the compromised server.
6. Use the DHCP server’s network position and privileges to disrupt network services, collect data, or pivot to other internal systems.

How to detect it

Look for evidence of suspicious DHCP traffic followed by instability or compromise of the Windows DHCP Server service. Useful sources include Windows System logs, Application logs, Microsoft-Windows-DHCP-Server operational logs, DHCP audit logs under the Windows DHCP log directory, EDR process telemetry, crash dumps, firewall logs, NetFlow, packet captures, and IDS telemetry for UDP/67 and UDP/68. Investigate DHCP Server service crashes, unexpected restarts, application faults involving svchost.exe or DHCP-related modules, and DHCP traffic from unauthorized hosts or segments. Correlate any crash or restart with inbound DHCP packets from the same source shortly before the event. Because there is no known public exploit maturity or KEV listing in the provided data, detection should focus on behavioral evidence: malformed or high-volume DHCP messages, anomalous clients sending DHCP traffic outside normal relay paths, DHCP service crashes, unexpected child processes from service-hosting processes, new files or tools dropped after a DHCP crash, and lateral movement originating from the DHCP server.

• %SystemRoot%\System32\Dhcp\DhcpSrvLog-*.log
• Microsoft-Windows-DHCP-Server/Operational
• DHCPServer
• DHCP Server service
• dhcpssvc
• dhcpssvc.dll
• Faulting application name: svchost.exe
• Faulting module name: dhcpssvc.dll
• The DHCP Server service terminated unexpectedly
• Event ID 7031
• Event ID 1000
• UDP/67
• UDP/68
• DHCPDISCOVER
• DHCPREQUEST
• DHCPINFORM
• DHCPOFFER
• DHCPACK

What your security team should do

• Inventory all Windows systems running the DHCP Server role and prioritize production DHCP servers for remediation.
• Apply the relevant Microsoft security update during the next emergency or high-priority patch window, especially on servers reachable from large or less-trusted network segments.
• Restrict DHCP service exposure to authorized broadcast domains, relay agents, and management-approved network paths.
• Review DHCP relay configurations and network ACLs to ensure untrusted adjacent networks cannot send DHCP traffic to vulnerable servers.
• Enable and retain Windows DHCP Server audit logs, System logs, Application logs, and network telemetry for DHCP traffic.
• Monitor for DHCP Server service crashes, unexpected restarts, malformed DHCP traffic, and unusual UDP/67 activity from non-relay hosts.
• If suspicious DHCP Server crashes or anomalous DHCP traffic are observed, preserve memory, collect DHCP logs, and investigate the host for post-exploitation activity.
• Track Microsoft guidance for this vulnerability because no separate fixed version list was provided in the input.