Description

Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:58.120Z",
  "pubdate": "2026-08-11T17:18:58.120Z",
  "executiveSummary": "This vulnerability involves uncontrolled resource consumption within the Windows DHCP Client, classified as a denial of service (DoS) vulnerability.\nThe primary impact of successful exploitation is the exhaustion of system resources, leading to a denial of service on the affected host and disrupting network connectivity.\nThe affected product is the Windows DHCP Client.\nThe risk implications include operational disruption, loss of network manageability, and potential cascading availability failures across enterprise segments relying on automated IP configuration.\nAn unauthorized threat actor requires positioning on an adjacent network to successfully target the vulnerable component.\nExploitation requirements are limited to network adjacency, allowing the attacker to transmit malformed or excessive DHCP messaging directly to the victim interface without requiring prior authentication or user interaction.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate bounds checking, rate limiting, and resource allocation controls within the Windows DHCP Client parsing engine when processing incoming Dynamic Host Configuration Protocol packets.\nThe vulnerable component is the Windows DHCP Client service responsible for handling lease negotiations, renewals, and network configuration state management.\nNetwork exposure is restricted to the local broadcast domain or adjacent network segment, as DHCP communication fundamentally relies on link-local broadcast or direct layer-2/layer-3 messaging.\nAuthentication requirements are nonexistent; the attacker operates without credentials, and privilege requirements are absent prior to exploitation since the attack targets the unauthenticated network ingestion vector of the OS.\nThe exploitation method involves the transmission of maliciously crafted or overwhelmingly frequent DHCP response packets, such as DHCPOFFER, DHCPACK, or malicious broadcast floods, designed to trigger excessive memory allocation, CPU thrashing, or handle exhaustion within the client-side parsing routines.\nThe step-by-step attack flow proceeds as follows: First, the unauthorized attacker establishes presence on the adjacent network segment. Second, the attacker crafts specialized DHCP payloads engineered to exploit the resource management deficiencies of the Windows DHCP Client. Third, the attacker transmits these payloads toward the target host. Fourth, upon receipt, the Windows DHCP Client attempts to process the anomalous data streams, failing to release or bound allocated memory structures. Fifth, continuous injection of these payloads drives system resource consumption to critical thresholds. Finally, the target system experiences severe degradation or complete failure of the DHCP client service, resulting in a denial of service state where the host cannot renew or acquire IP leases."
}