Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:26.197Z",
  "pubdate": "2026-08-11T17:18:26.197Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also known as a wrap or wraparound condition, residing within the Windows DHCP Server component.\nThe primary security impact of this vulnerability is unauthorized information disclosure, allowing an adversary to extract sensitive data from the targeted system.\nThe affected product is the Windows DHCP Server, which handles dynamic host configuration for local network environments.\nThe risk implications include the potential leakage of internal network configurations, memory contents, or other sensitive operational data processed by the DHCP service.\nTo execute an attack, the threat actor must possess unauthorized status and operate from an adjacent network, typically requiring physical or logical presence on the same local segment to interact directly with the DHCP server endpoints.\nNo specific authentication requirements are indicated beyond network adjacency, enabling unauthenticated threat actors on the local network link to trigger the vulnerable code path.",
  "technicalDetails": "The root cause of the vulnerability is an integer underflow condition within the arithmetic operations handling packet lengths or buffer sizes inside the Windows DHCP Server service.\nWhen processing malformed or specifically crafted DHCP packets received over the network, the underlying parsing logic performs a subtraction that results in an integer wrap.\nThis arithmetic miscalculation typically leads to downstream memory management anomalies, such as incorrect buffer allocation sizes or invalid boundary checks during packet deserialization.\nThe vulnerable component is the Windows DHCP Server binary responsible for parsing incoming network requests and managing lease assignments.\nThe attack vector relies on network exposure, specifically requiring the attacker to be positioned on an adjacent network where they can transmit crafted DHCP frames directly to the listening server interface.\nThe exploitation flow proceeds step-by-step as follows: First, the unauthorized attacker crafts a malicious DHCP packet designed to manipulate length fields or internal offset counters. Second, the attacker transmits this packet over the adjacent network to the target Windows DHCP Server. Third, the server parses the incoming frame, invoking the vulnerable function where the arithmetic operation triggers an integer underflow. Fourth, due to the wrap condition, subsequent memory read operations fail to respect intended buffer boundaries, causing the service to read out-of-bounds memory. Finally, the server inadvertently includes portions of this sensitive memory data in its response back to the attacker, resulting in unauthorized information disclosure.\nThe privilege requirements for this attack are minimal regarding system credentials, as the attacker requires only network adjacency to communicate with the DHCP service daemon.\nPost-exploitation impact is centered around information disclosure, which may yield memory contents containing cryptographic material, internal IP architecture details, or state data useful for chaining further attacks against the local network segment."
}