CVE-2026-56159

What it actually does

This is a remotely reachable heap-based buffer overflow in the Windows DHCP Server service. An unauthenticated attacker can send crafted DHCP network traffic to a vulnerable DHCP server and corrupt heap memory in the service process. Successful exploitation can lead to arbitrary code execution with the privileges of the DHCP Server service, potentially giving the attacker control over the affected server. Because the issue is network-accessible, requires no user interaction, and requires no prior authentication, the technical severity is critical.

Why it matters to the business

A compromised DHCP server can disrupt network address assignment, cause widespread connectivity outages, and give an attacker a foothold on high-value infrastructure. Since DHCP servers are commonly deployed on Windows Server systems and often have broad visibility into internal networks, compromise could support lateral movement, credential theft, service disruption, or manipulation of network configuration. Although this issue is not currently listed in CISA KEV and exploit maturity is reported as none, the CVSS 9.8 rating and unauthenticated network attack surface make timely remediation important, especially for internet-exposed, partner-accessible, or broadly reachable DHCP services.

How an attack unfolds

An attacker first identifies a Windows system running the DHCP Server role and reachable over DHCP-related network paths, typically UDP/67. The attacker then sends malformed or specially crafted DHCP packets intended to trigger the heap overflow in the server-side DHCP processing logic. If memory corruption is controlled reliably, the attacker may divert execution flow and run code inside the DHCP Server service process. A failed attempt may crash or restart the DHCP Server service, while a successful attempt may result in unauthorized command execution, persistence deployment, credential access, network reconnaissance, or use of the DHCP server as a staging point for further internal activity.

How to fix it

Apply the Microsoft security update that fixes this vulnerability for all affected Windows versions, including Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce exposure by restricting DHCP service reachability to only trusted network segments, blocking unnecessary inbound access to UDP/67 at network boundaries, and ensuring DHCP servers are not reachable from untrusted networks. Monitor DHCP Server service stability closely until patched. Avoid disabling DHCP as a mitigation unless an approved operational fallback exists, because doing so may interrupt network connectivity for clients.

How to confirm the fix worked

Confirm that all affected Windows systems have installed the relevant Microsoft security update released for this issue. Validate exposure by inventorying systems with the DHCP Server role enabled and confirming whether UDP/67 is reachable only from expected client networks. On Windows, review installed updates, OS build information, and DHCP Server role status using standard endpoint management, vulnerability scanning, or PowerShell-based inventory. After remediation, perform an authenticated vulnerability scan or configuration assessment to verify the host is no longer reported as vulnerable. Also verify that DHCP service functionality remains normal and that event logs do not show repeated DHCP Server crashes or abnormal restarts after patching.

Typical attack path

1. Identify a reachable Windows DHCP Server instance, commonly through internal network scanning or observation of DHCP traffic.
2. Send crafted DHCP packets to the server over the DHCP service port.
3. Trigger heap memory corruption in the Windows DHCP Server service.
4. Achieve service crash, denial of service, or arbitrary code execution depending on exploit reliability.
5. If code execution succeeds, run commands in the context of the DHCP Server service process.
6. Establish persistence, collect credentials or network information, and attempt lateral movement to other systems.

How to detect it

To determine whether exploitation may have already occurred, review Windows Event Logs for DHCP Server service crashes, abnormal restarts, and service control events around the time of unusual DHCP traffic. Relevant sources include System logs for Service Control Manager events, Application Error or Windows Error Reporting entries involving DHCP Server components, and Microsoft-Windows-DHCP-Server operational or admin logs. Examine DHCP text logs under the Windows DHCP log directory for unusual bursts, malformed request patterns, repeated requests from unexpected MAC addresses, or activity from network segments that should not communicate with the server. Network telemetry should be checked for unusual UDP/67 traffic, oversized or malformed DHCP packets, repeated DHCP messages from a single source, and DHCP traffic crossing network boundaries where it should normally be blocked. Endpoint telemetry should be reviewed for suspicious activity by the DHCP Server service host, including unexpected process creation, script execution, dropped files, new services, registry run keys, credential access attempts, or outbound connections initiated shortly after DHCP Server errors. Because no public exploit indicators are provided, detection should focus on behavioral evidence: service instability followed by suspicious execution or network activity from the DHCP server.

• %SystemRoot%\System32\dhcp\DhcpSrvLog-*.log
• Microsoft-Windows-DHCP-Server
• Microsoft-Windows-DHCP-Server/Admin
• Microsoft-Windows-DHCP-Server/Operational
• DHCPServer
• DHCP Server service
• Service Control Manager
• The DHCP Server service terminated unexpectedly
• The DHCP Server service entered the stopped state
• The DHCP Server service entered the running state
• Application Error
• Windows Error Reporting
• dhcpssvc.dll
• svchost.exe
• UDP/67
• port 67

What your security team should do

• Prioritize patching Windows DHCP Server systems, especially domain controllers or infrastructure servers that also host DHCP, and any DHCP servers reachable from large or less-trusted network segments.
• Inventory all Windows systems with the DHCP Server role enabled across the affected product versions.
• Restrict UDP/67 access to trusted client broadcast domains and administrative network paths; prevent DHCP service exposure across untrusted boundaries.
• Increase monitoring for DHCP Server service crashes, unexpected restarts, anomalous DHCP packet volume, and suspicious child processes spawned from service-hosting processes.
• Review recent DHCP Server logs and Windows event logs for signs of malformed traffic, service instability, or post-exploitation behavior.
• If patching must be delayed, implement compensating controls such as network segmentation, firewall rules, IDS/IPS signatures for malformed DHCP traffic, and heightened EDR monitoring on DHCP servers.
• Because exploit maturity is currently reported as none and the issue is not in KEV, use risk-based prioritization, but treat the vulnerability as urgent due to unauthenticated remote code execution potential.