CVE-2026-50518

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows DHCP Server service. A remote, unauthenticated attacker can send specially crafted network traffic to the DHCP service and cause memory corruption in the server process. Because the flaw is reachable over the network, requires no user interaction, and has high confidentiality, integrity, and availability impact, successful exploitation can result in arbitrary code execution in the context of the DHCP Server service, service crashes, or full compromise of the affected Windows server depending on service privileges and exploit reliability.

Why it matters to the business

A compromised DHCP server can disrupt address assignment across an organization, causing widespread network connectivity failures for workstations, servers, printers, phones, and other managed devices. If exploited for code execution, the server could become an internal foothold for lateral movement, credential theft, malware deployment, or manipulation of network configuration delivered to clients. The affected product set includes multiple Windows Server generations, making this broadly relevant for organizations that rely on Microsoft DHCP infrastructure. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the severity is critical and the network-reachable, unauthenticated nature of the flaw makes timely remediation important.

How an attack unfolds

An attacker first identifies a reachable Windows DHCP Server instance, typically by finding systems listening for DHCP traffic on UDP ports 67 and 68 or by targeting a server already known to provide DHCP services. The attacker then sends a malformed DHCP request or related protocol message designed to trigger the heap buffer overflow in the Windows DHCP Server implementation. If the crafted data corrupts heap memory in a controlled way, the attacker may redirect execution flow and run attacker-supplied code within the DHCP service process. After code execution, the attacker can establish persistence, enumerate the server and network, attempt credential access, alter DHCP configuration such as DNS/router options, or use the server as a pivot point to reach other internal systems. Failed exploitation attempts may instead crash the DHCP service, resulting in denial of service and client address-assignment failures.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows and Windows Server versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Configuration Manager, or other enterprise patch tooling. Prioritize systems running the DHCP Server role on Windows Server 2012, 2016, 2019, 2022, and 2025, as well as any affected Windows 10 systems with DHCP server functionality enabled. Because no fixed version list was provided, verify remediation against the official Microsoft Security Update Guide for CVE-2026-50518 and confirm that the installed cumulative update level supersedes the July 2026 security update addressing this issue. Where immediate patching is not possible, restrict DHCP service exposure to trusted network segments, block untrusted traffic to UDP/67 and UDP/68 at network boundaries, disable the DHCP Server role on systems that do not require it, isolate critical DHCP servers, monitor for abnormal DHCP packet volume, and ensure service recovery plans are in place.

How to confirm the fix worked

Confirm whether each affected system has the DHCP Server role installed and running, then verify that the applicable Microsoft security update or later cumulative update is installed. On Windows systems, review installed hotfixes and cumulative update history using tools such as Windows Update history, Get-HotFix, DISM package inventory, Microsoft Defender Vulnerability Management, WSUS, Configuration Manager, or other endpoint management platforms. Validate exposure by checking whether the DHCP Server service is listening and reachable only from expected trusted network segments. Confirm that firewall rules restrict inbound DHCP traffic appropriately and that no unnecessary hosts are running the DHCP Server service. After patching, restart if required, confirm the DHCP Server service is healthy, and perform controlled DHCP lease acquisition testing from an authorized client network.

Typical attack path

1. Identify or reach a Windows system running the DHCP Server role.
2. Confirm DHCP service exposure by probing DHCP-related traffic paths, commonly UDP/67 server-side and UDP/68 client-side behavior.
3. Send specially crafted DHCP packets intended to trigger the heap-based buffer overflow.
4. Achieve memory corruption in the DHCP Server service process.
5. Convert memory corruption into code execution or cause a service crash if exploitation is unreliable.
6. Use the compromised DHCP server to run commands, stage malware, collect credentials, alter DHCP options, or pivot deeper into the network.

How to detect it

To assess possible prior exploitation, review DHCP Server operational logs, Windows System and Application event logs, service-control events, crash dumps, endpoint detection telemetry, and network DHCP traffic captures. Look for unexpected DHCP Server service crashes or restarts, heap corruption or application fault events involving the DHCP service process, abnormal bursts of malformed DHCP packets, DHCP traffic from unusual segments, and any suspicious process creation from DHCP-related service contexts. Investigate changes to DHCP scopes and options, especially unauthorized DNS, gateway, proxy/WPAD, or domain-related values that could redirect client traffic. Correlate any DHCP service instability with inbound DHCP packets from unusual MAC addresses, relay agents, VLANs, or source networks. If EDR telemetry is available, hunt for command shells, scripting engines, network download tools, or credential-access tools launched by or shortly after DHCP service activity. Because no public exploit maturity is reported, detection should focus on behavioral evidence of service crashes, memory-corruption symptoms, anomalous DHCP traffic, and post-exploitation activity rather than a known exploit signature.

• UDP/67
• UDP/68
• DHCPServer
• DHCP Server
• Microsoft-Windows-DHCP-Server
• DHCPServer EventLog
• dhcpssvc.dll
• svchost.exe -k DHCPServer
• Application Error
• Faulting module name: dhcpssvc.dll
• Exception code: 0xc0000005
• The DHCP Server service terminated unexpectedly
• Service Control Manager
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• powershell.exe spawned by svchost.exe
• cmd.exe spawned by svchost.exe
• wscript.exe spawned by svchost.exe
• cscript.exe spawned by svchost.exe
• rundll32.exe spawned by svchost.exe
• regsvr32.exe spawned by svchost.exe

What your security team should do

• Immediately inventory all Windows systems running the DHCP Server role, with priority on Windows Server 2012, 2016, 2019, 2022, and 2025.
• Apply the Microsoft security update or a later cumulative update that remediates this vulnerability to all affected DHCP servers.
• Restrict DHCP traffic to expected local broadcast domains and trusted relay agents; block DHCP traffic from untrusted or routed networks where not required.
• Disable the DHCP Server role on any system that does not explicitly need to provide DHCP services.
• Increase monitoring for DHCP service crashes, unexpected restarts, abnormal DHCP request patterns, and suspicious child processes spawned by DHCP-related services.
• Review DHCP server configuration for unauthorized option changes, especially DNS server, router/gateway, WPAD, and domain search options.
• Prepare rollback and service-continuity plans before patching critical DHCP infrastructure, including failover partner validation where applicable.
• Because the flaw is critical and unauthenticated despite no current KEV listing, treat remediation as high priority and track for future exploit publication or KEV inclusion.