Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:26.540Z",
  "pubdate": "2026-08-11T17:18:26.540Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also known as a wrap or wraparound condition, residing within the Windows DHCP Server component.\nThe primary security impact of this flaw is unauthorized information disclosure, allowing an adversary to extract sensitive data from the targeted system.\nThe affected product is the Windows DHCP Server, which handles dynamic host configuration for local networks.\nThe risk implications include the potential leakage of memory contents or internal network metadata that could assist threat actors in planning subsequent, more destructive attacks.\nRegarding attacker capabilities, the vulnerability enables an unauthorized actor to trigger the condition and read memory contents without requiring prior authentication.\nThe exploitation requirement specifies that the attacker must be positioned on an adjacent network, such as the same local area network (LAN) or broadcast domain, to interact directly with the DHCP service.",
  "technicalDetails": "The root cause of the vulnerability is an integer underflow condition within the arithmetic operations handling packet lengths or buffer sizes inside the Windows DHCP Server.\nWhen processing maliciously crafted DHCP messages, the component fails to properly validate boundary conditions prior to performing subtraction operations.\nThis lack of bounds checking results in an integer wrap, where a small or negative value wraps around to a very large positive integer.\nThe vulnerable component is the Windows DHCP Server service, which processes incoming Dynamic Host Configuration Protocol requests and leases.\nNetwork exposure is limited to the adjacent network, as DHCP traffic typically operates over local broadcast and multicast domains using UDP ports 67 and 68.\nAuthentication and privilege requirements are minimal; an unauthorized attacker positioned locally on the adjacent network can initiate the exploitation sequence without possessing valid credentials.\nThe attack flow begins when the threat actor crafts a specialized DHCP packet containing manipulated length or size fields designed to trigger the arithmetic underflow.\nThe attacker transmits this malformed packet across the adjacent network to the target Windows DHCP Server.\nUpon receipt, the DHCP Server parses the packet and executes the vulnerable arithmetic routine, resulting in the calculation of an incorrect buffer size due to the integer wraparound.\nThis miscalculation subsequently leads to out-of-bounds read operations when the server attempts to read from or copy data using the flawed length parameters.\nThe payload behavior leverages this out-of-bounds read condition to access adjacent memory regions containing sensitive data structures.\nThe post-exploitation impact is characterized by unauthorized information disclosure, wherein the server inadvertently echoes or returns portions of its memory contents back to the attacker via response packets, exposing internal system data."
}