Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:22.340Z",
  "pubdate": "2026-08-11T17:18:22.340Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also known as a wrap or wraparound condition, residing within the Windows DHCP Server component.\nThe primary security impact of this flaw is unauthorized information disclosure, allowing an adversary to read sensitive memory contents over the network.\nThe affected product is the Windows DHCP Server across supported architectural deployments.\nThe risk implications include the potential exposure of critical system memory or internal state data, which could facilitate subsequent exploitation phases.\nTo execute this attack, the threat actor requires the capability to communicate with the target over an adjacent network segment.\nNo explicit authentication is required for the attacker, as the vulnerability can be leveraged by unauthorized entities positioned on the local network adjacent to the vulnerable DHCP service.",
  "technicalDetails": "The root cause of the vulnerability is an integer underflow condition within the memory management or packet parsing logic of the Windows DHCP Server.\nAn integer underflow occurs when an arithmetic operation results in a value that is too small to fit within the designated integer representation, causing it to wrap around to a unexpectedly large positive value.\nThe vulnerable component is the Windows DHCP Server service responsible for processing incoming Dynamic Host Configuration Protocol requests and managing lease allocations.\nThe network exposure is restricted to the adjacent network, meaning the attacker must be on the same local network segment or broadcast domain to interact directly with the DHCP server endpoints.\nAuthentication requirements are nonexistent, and privilege requirements are absent, permitting unauthorized adjacent attackers to trigger the flaw.\nThe exploitation method relies on the attacker crafting and transmitting a malformed DHCP packet designed to manipulate integer values during size calculations or buffer offset determinations.\nThe step-by-step attack flow proceeds as follows: First, the unauthorized attacker transmits a maliciously crafted DHCP message targeting the Windows DHCP Server over the adjacent network. Second, the server parses the incoming packet headers and fields, performing arithmetic operations that trigger the integer underflow condition. Third, due to the wrap-around effect, subsequent buffer allocation or read length routines miscalculate the boundaries of the data structures. Fourth, the server reads out-of-bounds memory or returns memory contents back to the requester as part of its normal protocol response handling or error messaging. Finally, the attacker captures the response packet, extracting the sensitive information leaked from the server's heap or stack memory.\nThe post-exploitation impact is strictly centered around information disclosure, potentially exposing internal memory structures, pointers, or auxiliary system data that aids in mapping the network or planning further attacks."
}