CVE-2026-50683

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows DHCP Server service. An attacker with authorized access from an adjacent network can send specially crafted DHCP-related traffic that corrupts heap memory in the DHCP service process, potentially allowing elevation of privilege and execution of attacker-controlled code in the security context of the DHCP Server service. Because the CVSS vector indicates high confidentiality, integrity, and availability impact, successful exploitation could allow the attacker to take over the DHCP service host, modify network configuration data, disrupt address assignment, or use the server as a foothold for broader internal compromise.

Why it matters to the business

Compromise of a Windows DHCP Server can disrupt network connectivity, affect endpoint onboarding, and give an attacker a privileged foothold inside core infrastructure. DHCP servers are often trusted network services, so exploitation could lead to service outages, unauthorized network configuration changes, and further lateral movement. The issue affects multiple Windows client and server generations, including Windows Server 2012 through Windows Server 2025 and several Windows 10 releases, increasing the likelihood that legacy or long-lived infrastructure may be exposed. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the high severity and low attack complexity warrant timely patching and segmentation review.

How an attack unfolds

An attacker first gains a position on the same or adjacent network segment as a Windows DHCP Server and has the level of authorization required by the vulnerability conditions. They identify an affected DHCP Server instance, then send malformed DHCP traffic designed to trigger unsafe heap memory handling in the DHCP Server service. If the memory corruption is reliably controlled, the attacker can cause the service to crash or potentially redirect execution flow to attacker-controlled code. Successful exploitation can elevate the attacker's privileges on the DHCP Server host, after which they may alter DHCP scopes or options, deploy malicious network configuration, collect sensitive configuration data, disable the service, or use the compromised server to pivot to other internal systems. There are no named threat actors or confirmed exploitation campaigns reported in the provided data.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for each affected Windows version as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, or enterprise patch management tooling. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official security update guidance for the affected releases: Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. If immediate patching is not possible, reduce exposure by restricting DHCP Server access to trusted network segments only, blocking unauthorized access to DHCP service traffic, disabling the DHCP Server role where it is not required, enforcing DHCP snooping and network access controls on switches, and monitoring for DHCP service crashes or abnormal DHCP request patterns. Ensure DHCP servers are not reachable from untrusted VLANs or guest networks except where explicitly required.

How to confirm the fix worked

Confirm that all Windows systems running the DHCP Server role have received the applicable Microsoft security update for their operating system version. Validate patch deployment using centralized patch inventory, Windows Update history, installed hotfix records, or Microsoft Update Compliance tooling. Confirm the DHCP Server role is only present on intended systems and that network controls limit DHCP traffic to authorized client segments. Test that DHCP services remain functional after patching by renewing leases from representative client networks and verifying scope assignment. Exposure can be checked by enumerating hosts with the DHCP Server role installed and reviewing firewall, VLAN, and ACL rules for access to UDP ports 67 and 68. A system should not be considered remediated solely because perimeter firewalls block access; adjacent internal network exposure must also be reviewed.

Typical attack path

1. Obtain access to an adjacent or local network segment where DHCP Server traffic can reach an affected Windows DHCP Server.
2. Identify Windows DHCP Server instances by observing DHCP traffic or probing for DHCP service behavior.
3. Use authorized access conditions required by the flaw to interact with the DHCP Server service.
4. Send specially crafted DHCP packets or requests that trigger heap memory corruption in the DHCP Server process.
5. Achieve service crash, denial of service, or controlled code execution depending on exploit reliability.
6. Escalate privileges on the DHCP Server host through code execution in the service context.
7. Modify DHCP configuration, disrupt address assignment, or use the host as an internal pivot point.

How to detect it

Investigating prior exploitation should focus on evidence of DHCP Server instability, abnormal DHCP traffic, and unauthorized DHCP configuration changes. Review Windows System, Application, Microsoft-Windows-DHCP Server Events/Operational, and Microsoft-Windows-DHCP Server Events/Admin logs for DHCP Server service crashes, unexpected restarts, memory access violations, or error reporting events involving the DHCP Server service or dhcpssvc.dll. Look for Windows Error Reporting events, Service Control Manager events indicating the DHCP Server service terminated unexpectedly, and application crash events where svchost.exe hosting DHCP Server faults in dhcpssvc.dll. Network telemetry should be reviewed for unusual bursts of DHCP requests, malformed DHCP options, unexpected relay-agent behavior, or DHCP traffic from unauthorized adjacent segments. Configuration review should check for recent unauthorized changes to scopes, reservations, exclusions, DNS options, router options, WPAD/proxy settings, PXE/boot options, and lease behavior. Because no public exploit maturity or unique malware indicators were provided, absence of known IOCs does not rule out exploitation; prioritize behavioral evidence and crash artifacts around the time of suspicious DHCP activity.

• Microsoft-Windows-DHCP Server Events/Operational
• Microsoft-Windows-DHCP Server Events/Admin
• DHCPServer
• dhcpssvc.dll
• svchost.exe -k DHCPServer
• Faulting application name: svchost.exe
• Faulting module name: dhcpssvc.dll
• The DHCP Server service terminated unexpectedly
• Service Control Manager
• Windows Error Reporting
• Application Error
• UDP/67
• UDP/68
• %SystemRoot%\System32\dhcpssvc.dll
• %SystemRoot%\System32\dhcp\DhcpSrvLog-

What your security team should do

• Prioritize patching Windows systems running the DHCP Server role, especially domain infrastructure, datacenter DHCP servers, and servers reachable from broad internal network segments.
• Create an inventory of all Windows hosts with the DHCP Server role enabled across Windows Server 2012, 2016, 2019, 2022, and 2025, as well as affected Windows 10 systems where applicable.
• Restrict DHCP service exposure to trusted VLANs and authorized relay paths; block unnecessary DHCP traffic from guest, user, wireless, and untrusted network segments.
• Enable or review DHCP snooping, port security, and network access controls on switches to limit unauthorized DHCP interactions.
• Monitor DHCP Server operational logs, Windows System logs, and application crash telemetry for DHCP Server service crashes or malformed request patterns.
• Review DHCP scopes and options for unauthorized changes, including rogue gateway, DNS, proxy, or boot server settings.
• If patching must be delayed, consider temporarily moving DHCP services behind stricter network controls or to patched hosts.
• After remediation, run validation checks to confirm patch installation, service health, and continued DHCP lease issuance.