Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:22.697Z",
  "pubdate": "2026-08-11T17:18:22.697Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also known as a wrap or wraparound condition, residing within the Windows DHCP Server component.\nThe primary security impact of this flaw is unauthorized information disclosure, allowing an adversary to read sensitive memory contents or operational data.\nThe affected system is the Windows DHCP Server when processing specific network packets or internal state calculations.\nThe risk implications include the potential leakage of critical system memory or configuration details, which could facilitate subsequent, more severe compromise attempts.\nAn unauthorized attacker possessing positioning on an adjacent network can exploit this vulnerability without requiring authentication.\nNo specific preconditions or privileged access are explicitly stated beyond adjacency to the target network segment, enabling localized exploitation vectors against vulnerable service listeners.",
  "technicalDetails": "The root cause of the vulnerability stems from an integer underflow condition within the Windows DHCP Server service.\nInteger underflows occur when an arithmetic operation attempts to decrease a numerical value below the minimum allowable limit of its data type, resulting in a wrap-around to a large positive integer or an unexpected state.\nIn the context of the Windows DHCP Server, this computational flaw likely manifests during the parsing, sizing, or boundary calculation of incoming DHCP message fields, options, or lease buffers.\nBecause the server fails to adequately validate or sanitize boundary constraints prior to performing memory allocation or buffer offset arithmetic, the resulting wrapped value misrepresents the actual size or index requirements.\nThe vulnerable component is the Windows DHCP Server network packet processing engine.\nThe attack vector requires network exposure on an adjacent network, meaning the attacker must be on the same local broadcast domain or directly connected subnet to interact with the DHCP service listener.\nAn unauthorized attacker leverages this exposure by transmitting a maliciously crafted DHCP request or sequence of packets designed to trigger the arithmetic wraparound during server-side processing.\nUpon receipt of the malformed input, the flawed parsing logic executes the vulnerable calculation, resulting in an incorrect size parameter or offset.\nWhen the Windows DHCP Server subsequently processes memory operations using this corrupted integer, it reads beyond the intended boundaries of the allocated buffer due to the miscalculated length.\nThis out-of-bounds read condition leads directly to the disclosure of adjacent memory contents, returning sensitive residual data from the heap or stack back to the attacker via protocol responses or internal logging mechanisms.\nThe authentication requirement is none, and privilege requirements are absent, as the service processes unauthenticated client traffic from the local network segment."
}