CVE-2026-54128

What it actually does

This is a local, unauthenticated use-after-free vulnerability in the Windows DHCP Client component. A local attacker can trigger unsafe reuse of freed memory in the DHCP client service and potentially redirect execution flow to attacker-controlled code. Successful exploitation can result in arbitrary code execution on the affected Windows system, likely in the security context of the vulnerable DHCP Client service process, with high impact to confidentiality, integrity, and availability.

Why it matters to the business

If exploited, this flaw can allow an attacker who already has local access to a Windows workstation or server to run code, deepen compromise, disable security controls, steal data, or use the system as a launch point for broader intrusion. Because the affected products include many supported Windows desktop and server versions, exposure can be widespread across enterprise fleets. Although it is not currently listed in CISA KEV and no mature public exploit is indicated, the high CVSS score and low attack complexity make timely patching important.

How an attack unfolds

An attacker first obtains the ability to run code locally on an affected Windows system, such as through malware execution, abuse of a low-privilege local account, or another initial-access technique. The attacker then interacts with the Windows DHCP Client component in a way that triggers the use-after-free condition. By shaping memory layout and causing the service to access memory after it has been freed, the attacker attempts to place controlled data where the DHCP Client expects a valid object. If successful, execution is redirected to attacker-controlled instructions, allowing code execution on the local machine. The attacker can then use the gained execution to persist, tamper with endpoint defenses, access sensitive data, or move laterally depending on the privileges and service context obtained.

How to fix it

Apply the Microsoft security update that fixes CVE-2026-54128 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. No specific fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official Security Update Guide and the relevant cumulative update for each supported Windows release. Prioritize internet-facing servers, shared workstations, jump hosts, VDI images, developer workstations, and systems where untrusted users can obtain local access. Where patching is delayed, reduce local attack surface by restricting interactive logon, limiting execution of untrusted binaries, enforcing application control, enabling endpoint protection, and monitoring DHCP Client service crashes or abnormal child-process behavior. Disabling the DHCP Client service is generally not recommended on managed endpoints because it may disrupt network configuration, but it may be considered only for tightly controlled systems using static addressing after operational testing.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative update or security update that includes the fix for CVE-2026-54128. Use centralized patch management, vulnerability scanning, or Windows inventory tooling to verify OS build and update level against Microsoft’s official fixed release information. Validate that the DHCP Client service is running the patched binaries after reboot where required. Check that vulnerability scanners no longer report the CVE on Windows 10, Windows 11, and Windows Server assets. For high-risk systems, also review recent Windows Error Reporting, Application, System, and Microsoft-Windows-Dhcp-Client logs for DHCP Client or svchost.exe crashes before and after patching; recurring crashes before remediation may warrant forensic review.

Typical attack path

1. Gain local execution on an affected Windows workstation or server.
2. Trigger the vulnerable DHCP Client code path through local interaction with DHCP client functionality or related service behavior.
3. Groom process memory so freed memory is replaced with attacker-controlled content.
4. Exploit the use-after-free condition to redirect execution flow.
5. Execute attacker-controlled code in the context of the vulnerable process or service.
6. Use the resulting access to escalate the intrusion, disable defenses, establish persistence, or move laterally.

How to detect it

There are no known public exploit indicators or KEV-confirmed exploitation details in the provided data, so detection should focus on behavioral and forensic evidence rather than fixed signatures. Review Windows Application, System, Security, Windows Error Reporting, and Microsoft-Windows-Dhcp-Client logs for crashes or abnormal restarts of the DHCP Client service, especially involving svchost.exe and DHCP-related modules. Investigate svchost.exe instances associated with the DHCP Client service that spawn unusual child processes such as command shells, PowerShell, script interpreters, LOLBins, or unknown executables. Correlate suspicious local execution, privilege changes, service creation, scheduled task creation, endpoint protection tampering, and credential-access activity occurring shortly after DHCP Client crashes or service restarts. On EDR platforms, hunt for memory-corruption symptoms, repeated process crashes, exploit-mitigation alerts, or abnormal code injection into svchost.exe. Because this is a local code-execution issue, also correlate with signs of initial local foothold such as newly dropped executables, suspicious user logons, or malware detections on the same host.

• Microsoft-Windows-Dhcp-Client
• Microsoft-Windows-Dhcp-Client/Admin
• Microsoft-Windows-Dhcp-Client/Operational
• Dhcp
• DHCP Client
• svchost.exe
• dhcpcore.dll
• dhcpcsvc.dll
• dhcpcsvc6.dll
• Faulting application name: svchost.exe
• Faulting module name: dhcpcore.dll
• Faulting module name: dhcpcsvc.dll
• Faulting module name: dhcpcsvc6.dll
• Service Control Manager
• Windows Error Reporting
• werfault.exe

What your security team should do

• Prioritize deployment of the relevant Microsoft security update across affected Windows desktop and server fleets.
• Treat systems with local multi-user access, shared administrative use, VDI, jump-host functions, or elevated business criticality as highest priority.
• Verify remediation with authenticated vulnerability scanning or patch inventory rather than relying only on deployment success status.
• Hunt for pre-patch DHCP Client service crashes, svchost.exe instability, abnormal child processes, or suspicious local code execution around DHCP-related service activity.
• Ensure endpoint detection and response tooling monitors svchost.exe behavior, especially unexpected process creation, script execution, credential access, or security-control tampering.
• Restrict local logon and execution rights for untrusted users and enforce application control where feasible.
• Monitor Microsoft advisories for fixed build details, exploit availability, or any future KEV listing that would increase urgency.