Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:21.993Z",
  "pubdate": "2026-08-11T17:18:21.993Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also known as wrap or wraparound, affecting the Windows DHCP Server component.\nThe primary security impact of this flaw is unauthorized information disclosure across an adjacent network.\nThe affected product is the Windows DHCP Server, which handles dynamic host configuration for network clients.\nThe risk implication is that an unauthorized attacker can potentially harvest sensitive data exposed by the vulnerable server memory handling during DHCP message processing.\nAttacker capabilities are limited to information disclosure, requiring positioning on the same adjacent network to interact directly with the DHCP server endpoints.\nNo specific authentication or specialized user privileges are required for the attacker to trigger the condition, provided network adjacency is established.",
  "technicalDetails": "The root cause of the vulnerability resides in an integer underflow condition within the memory management or length-calculation logic of the Windows DHCP Server.\nInteger wrap or wraparound occurs when an arithmetic operation attempts to create a value that is too small for the designated integer type, causing it to wrap around to a very large number.\nIn the context of the Windows DHCP Server, processing malformed or specifically crafted DHCP packets can lead to incorrect buffer size calculations.\nWhen the vulnerable component computes bounds or allocation sizes based on unvalidated packet fields, the integer underflow results in a mismatched allocation or read size.\nThe attack flow begins when an unauthorized attacker on an adjacent network transmits a maliciously crafted DHCP request packet to the target Windows DHCP Server.\nUpon receiving the payload, the vulnerable DHCP Server component parses the packet fields without performing adequate bounds checking or input validation.\nThe flawed arithmetic operation triggers the integer underflow, causing the parsing routine to miscalculate memory offsets or read boundaries.\nConsequently, when the server attempts to read or echo data back based on these flawed calculations, it accesses adjacent memory regions outside the intended buffer bounds.\nThis out-of-bounds read condition leads to the disclosure of sensitive memory contents, potentially exposing internal server state, stack data, or remnants of previous network transactions.\nThe exploitation vector requires network adjacency, meaning the attacker must be present on the local broadcast domain or subnet capable of communicating directly with the DHCP service interface.\nThe vulnerability does not inherently provide remote code execution capabilities based on the provided description, strictly restricting the post-exploitation impact to unauthorized information disclosure."
}