Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:21.843Z",
  "pubdate": "2026-08-11T17:18:21.843Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also referred to as a wrap or wraparound condition, residing within the Windows DHCP Server component. The security flaw permits an unauthorized threat actor to successfully execute information disclosure against target environments.\nThe operational impact of this vulnerability centers on unauthorized memory or data exposure, potentially leaking sensitive information that could facilitate subsequent exploitation phases. The affected system is the Windows DHCP Server, which handles dynamic host configuration allocation within enterprise and local networks.\nRisk implications are moderate to high depending on the architectural sensitivity of the leaked data residing in proximity to the affected buffer structures. Regarding attacker capabilities and requirements, the exploit vector requires the malicious actor to operate over an adjacent network, meaning they must share a local network segment or Layer 2 domain with the vulnerable Windows DHCP Server to interact with the service directly.\nNo elevated privileges or prior authentication are strictly required to initiate the attack flow, as standard interactions with the DHCP service occur prior to session establishment. Successful exploitation relies on the server processing malformed DHCP messages that trigger the arithmetic wrap condition during internal size calculations or buffer offset indexing.",
  "technicalDetails": "The fundamental root cause of this vulnerability stems from an arithmetic integer underflow within the Windows DHCP Server binary during the parsing and handling of incoming network packets. When the DHCP service computes buffer lengths or memory allocations based on fields supplied within a DHCP request, a lack of comprehensive bounds checking allows an attacker-controlled input to decrement a value below zero.\nThis arithmetic wrap transforms a small or zero integer into a massive positive value due to integer rollover mechanics. Consequently, subsequent memory copy or read operations misinterpret this wrapped integer as the boundary size for data processing.\nThe vulnerable component is the Windows DHCP Server service, which processes Dynamic Host Configuration Protocol packets sent across the local network medium. Because the vulnerability is exposed over an adjacent network, an unauthorized attacker positioned on the same local broadcast domain can transmit crafted DHCP frames directly to the listening server interface.\nThe step-by-step attack flow proceeds as follows. First, the attacker crafts a malicious DHCP packet containing specially manipulated header or option fields designed to force an integer underflow upon parsing. Second, the attacker transmits this packet onto the adjacent network targeting the IP address of the Windows DHCP Server.\nThird, the vulnerable DHCP service receives the payload and passes it to the internal parsing routines. During size validation or offset arithmetic, the supplied fields cause an integer wrap, bypassing expected validation checks.\nFourth, when the service attempts to read or echo data back based on the corrupted sizing logic, the operation reads out-of-bounds memory rather than the intended buffer region. Finally, the service inadvertently includes segments of this uninitialized or sensitive memory space in its response or handles it internally in a manner that allows the attacker to glean information regarding system memory layouts or internal state data.\nPost-exploitation impact is strictly bound to information disclosure, where the leaked memory contents may expose auxiliary pointers, stack data, or adjacent heap structures. This harvested intelligence can subsequently be leveraged by an attacker to defeat downstream mitigations or mount more advanced chained exploits against the underlying host."
}