CVE-2026-50685

What it actually does

This vulnerability is a double-free memory corruption flaw in Windows DHCP Server. An attacker who already has a low-privileged, authorized position capable of interacting with the DHCP Server service over the network can trigger unsafe memory management in the DHCP server process. Successful exploitation can corrupt heap state and may allow arbitrary code execution in the security context of the DHCP Server service. Because DHCP Server commonly runs with high local privileges on Windows Server systems, exploitation can result in full compromise of the affected server, including confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised DHCP server can disrupt IP address assignment, break network connectivity for users and systems, and provide an attacker a privileged foothold inside the network. Because DHCP infrastructure is often centrally placed and trusted, successful exploitation could support lateral movement, credential theft, service disruption, or manipulation of network configuration delivered to clients. The CVSS score is high at 7.5, but exploitation requires an authorized attacker and is rated high complexity; it is not currently listed in CISA KEV, not reported as ransomware-used, and no public exploit maturity is indicated, which reduces immediate mass-exploitation likelihood while still warranting timely patching of DHCP servers.

How an attack unfolds

An attacker first obtains authorized network access sufficient to communicate with the Windows DHCP Server service, such as access from an internal network segment or a compromised low-privileged account or device. The attacker then sends crafted DHCP-related network traffic that reaches the vulnerable service and triggers an error path or object lifecycle flaw causing the same memory allocation to be freed more than once. By carefully shaping repeated requests and heap state, the attacker attempts to convert the memory corruption into controlled code execution rather than only a service crash. If successful, attacker-controlled code executes in the DHCP Server service process context, allowing the attacker to install tools, dump credentials or tokens available to the server, alter DHCP behavior, disable services, or pivot to other systems. Because attack complexity is high and no mature exploit is currently reported, failed attempts may appear as DHCP Server service crashes, abnormal restarts, or malformed DHCP traffic before reliable code execution is achieved.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows DHCP Server systems, including Windows Server 2012, 2016, 2019, 2022, 2025, and affected Windows 10 releases where the DHCP Server component is present or enabled. Microsoft has not provided package-specific fixed version numbers in the supplied data, so use the latest cumulative update or security-only update applicable to each supported operating system release from Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or the organization’s endpoint/server patching platform. Prioritize systems running the DHCP Server role, especially domain-joined servers, servers reachable from untrusted or broad internal network segments, and systems that serve critical network ranges. If immediate patching is not possible, restrict network access to the DHCP Server service to only required client networks, block DHCP traffic from unauthorized segments, monitor for abnormal DHCP traffic, and consider moving DHCP service to patched or isolated servers. Remove or disable the DHCP Server role on systems where it is not required.

How to confirm the fix worked

Confirm that each affected host has the applicable Microsoft security update installed for its Windows version and patch cycle. Inventory systems with the DHCP Server role enabled and verify they are no longer running vulnerable update levels. Validate that the DHCP Server service remains functional after patching by confirming leases can be issued and renewed from expected network segments. Review firewall and network ACLs to ensure only authorized subnets can send DHCP traffic to DHCP servers. Where vulnerability scanning is available, run authenticated scans against Windows DHCP servers and confirm the CVE is no longer reported. Also confirm that no unsupported Windows versions remain in production without compensating controls.

Typical attack path

1. Gain authorized access to a network path where the Windows DHCP Server service can be reached.
2. Identify Windows DHCP Server instances on affected Windows Server or legacy Windows versions.
3. Send crafted DHCP protocol traffic or request sequences designed to trigger the double-free condition.
4. Manipulate heap layout through repeated interactions to improve reliability of memory corruption.
5. Achieve code execution in the DHCP Server service process context, or cause service instability if exploitation fails.
6. Use the compromised DHCP server to establish persistence, collect credentials, alter network configuration, disrupt address assignment, or move laterally.

How to detect it

To determine whether exploitation has already occurred, review Windows DHCP Server operational logs, Windows System logs, Application logs, security telemetry, endpoint detection records, and crash dumps from DHCP servers. Focus on signs of DHCP Server service instability, including unexpected service termination, restart loops, application crashes, heap corruption exceptions, Windows Error Reporting events, or faulting modules associated with the DHCP service process. Examine DHCP logs for unusual bursts of requests, malformed or repetitive DHCP message patterns, activity from unauthorized network segments, or traffic from a single MAC address or subnet immediately preceding a crash. Correlate network telemetry for UDP/67 and UDP/68 traffic spikes to DHCP servers. Because reliable public exploit indicators are not available and exploit maturity is listed as none, detection should emphasize behavioral artifacts rather than fixed signatures. If compromise is suspected, collect memory images, DHCP Server logs, Windows event logs, EDR process trees, scheduled tasks, services, autoruns, and recently written files. Investigate any unexpected child process creation from DHCP-related service processes, credential access attempts, new administrative accounts, remote management enablement, or lateral movement from the DHCP server. No specific threat actors are identified in the supplied data, and the vulnerability is not currently listed in CISA KEV or known ransomware use, so broad anomaly-based hunting is recommended.

• UDP traffic to DHCP server port 67 from unauthorized network segments
• High-volume or repetitive DHCP requests immediately preceding DHCP Server service crashes
• Event ID 7031 Service Control Manager DHCP Server service terminated unexpectedly
• Event ID 7034 Service Control Manager DHCP Server service terminated unexpectedly
• Event ID 1000 Application Error faulting application name: svchost.exe
• Event ID 1001 Windows Error Reporting svchost.exe
• DHCP Server service unexpected restart
• Faulting module associated with DHCP Server service
• Unexpected child process spawned by svchost.exe hosting DHCP Server
• C:\Windows\System32\dhcpssvc.dll
• C:\Windows\System32\dhcpsapi.dll
• C:\Windows\System32\winevt\Logs\Microsoft-Windows-DHCP Server%4Operational.evtx
• C:\Windows\System32\winevt\Logs\System.evtx
• C:\Windows\System32\LogFiles\WMI\DhcpSrvLog*.log

What your security team should do

• Prioritize patching all Windows servers running the DHCP Server role, especially those serving large or critical network segments.
• Create or update an inventory of all systems with the DHCP Server role installed, including legacy Windows Server 2012 and older Windows 10-based deployments.
• Restrict DHCP service exposure to expected client networks and prevent DHCP traffic from unauthorized VLANs, guest networks, VPN pools, and externally routed paths.
• Enable and centralize Windows DHCP Server logs, System event logs, Application event logs, and crash telemetry for DHCP Server service monitoring.
• Hunt for DHCP Server service crashes, unexpected restarts, malformed DHCP request bursts, and suspicious child processes spawned by DHCP-related services.
• Review privileged activity and credential exposure on any DHCP server showing instability or anomalous DHCP traffic around the publication and patch window.
• If patching must be delayed, isolate the DHCP server, reduce reachable network scope, and increase monitoring until updates are applied.