Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:35.163Z",
  "pubdate": "2026-08-11T17:18:35.163Z",
  "executiveSummary": "This vulnerability involves an integer underflow, also referred to as a wrap or wraparound condition, residing within the Windows DHCP Server component. The flaw permits an unauthorized attacker to successfully execute an information disclosure attack against targeted systems.\nThe primary impact of successful exploitation is unauthorized information disclosure, potentially exposing sensitive internal data or memory contents to malicious actors operating within the same network perimeter. The affected product is the Windows DHCP Server, and the risk implication centers on the compromise of confidentiality across local network segments.\nRegarding attacker capabilities and requirements, the vulnerability can be exploited by an unauthorized threat actor. However, successful exploitation requires network adjacency, meaning the attacker must have access to the same local or adjacent network as the vulnerable Windows DHCP Server to interact with the service and trigger the integer underflow condition.",
  "technicalDetails": "The root cause of the vulnerability is an integer underflow condition within the memory management or packet parsing logic of the Windows DHCP Server component. An integer underflow occurs when an arithmetic operation attempts to create a value that is too small to fit within the designated storage representation, leading to a wrap-around condition.\nIn the context of the Windows DHCP Server, this flaw is triggered when the service processes maliciously crafted DHCP packets containing specifically manipulated size or length parameters. When the vulnerable component performs calculations based on these untrusted inputs without proper bounds checking or validation, the resulting integer underflow produces an unexpectedly large unsigned integer or invalid buffer boundary reference.\nThe step-by-step attack flow begins with the unauthorized attacker positioned on an adjacent network capable of routing DHCP traffic or communicating directly with the Windows DHCP Server. The attacker crafts a specialized DHCP payload containing parameters designed to induce the integer underflow during parsing or buffer allocation routines. Upon transmitting this payload to the target server, the vulnerable component processes the request and improperly computes memory offsets or buffer sizes based on the wrapped integer value.\nBecause of this miscalculation, subsequent memory operations read outside the intended bounds of the allocated buffer. This behavior leads directly to the disclosure of adjacent memory contents, which may contain sensitive system data, network configurations, or intermediate runtime information. The payload behavior relies entirely on eliciting this out-of-bounds read condition rather than achieving remote code execution.\nThe vulnerability requires no authentication or special privileges from the attacker, other than network adjacency to the Windows DHCP Server. The network exposure is restricted to the local or adjacent broadcast/routing domain where DHCP communications take place. Post-exploitation impact is strictly limited to information disclosure, though the leaked memory contents could potentially be leveraged by an attacker to facilitate subsequent, more advanced attacks against the underlying operating system or network architecture."
}