Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:21.687Z",
  "pubdate": "2026-08-11T17:18:21.687Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also known as a wrap or wraparound condition, residing within the Windows DHCP Server component.\nThe primary impact of successful exploitation is the unauthorized disclosure of sensitive information across the network boundary.\nThe affected product is the Windows DHCP Server, which handles dynamic host configuration for client systems.\nThe risk implications include potential leakage of memory contents or internal state data, which could facilitate subsequent, more advanced exploitation phases.\nThe required attacker capabilities include unauthorized access over an adjacent network, meaning the threat actor must share a local network segment with the target DHCP server to interact with the service.\nThere are no explicit complex exploitation requirements mentioned beyond adjacent network connectivity and the ability to send maliciously crafted DHCP packets that trigger the underlying arithmetic boundary violation within the server logic.",
  "technicalDetails": "The root cause of the vulnerability is an integer underflow condition within the packet processing routines of the Windows DHCP Server. An integer underflow occurs when a mathematical operation results in a value that is too small to fit into the allocated integer data type, causing it to wrap around to a maximum value or an unexpected low value.\nIn the context of the Windows DHCP Server, this arithmetic flaw likely manifests during the parsing of incoming DHCP option lengths, header fields, or variable-length data structures where bounds checking fails to account for maliciously manipulated inputs.\nWhen the vulnerable component computes buffer sizes or offset indices based on untrusted network input, the resulting wrapped integer misrepresents the actual memory boundaries or data lengths.\nThe vulnerable component is the Windows DHCP Server service, specifically the routines responsible for decoding network frames and managing dynamic host configuration protocol transactions.\nRegarding authentication and privileges, the vulnerability can be leveraged by an unauthorized attacker, meaning no prior authentication or administrative privileges are required against the service to initiate the attack sequence.\nThe network exposure is restricted to an adjacent network, necessitating that the attacker resides on the same local broadcast domain or directly connected network segment to transmit the crafted DHCP payloads directly to the target server.\nThe attack flow proceeds as follows: First, the unauthorized attacker crafts a specialized network packet containing malformed DHCP option parameters designed to induce an integer underflow during parsing. Second, the attacker transmits this payload over the adjacent network to the Windows DHCP Server. Third, upon receiving the packet, the server executes the vulnerable arithmetic operation, resulting in an incorrect size calculation or buffer pointer assignment. Finally, due to the incorrect bounds or length evaluation, subsequent read operations access memory locations outside the intended buffers, copying internal data into outgoing DHCP response packets or logging mechanisms. This payload behavior ultimately results in the unauthorized disclosure of information to the attacker, exposing sensitive memory contents across the adjacent network."
}