Description

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:19:56.003Z",
  "pubdate": "2026-09-08T18:19:56.003Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists within the Windows DHCP Server service, representing a critical security flaw that allows for unauthenticated remote code execution.\nThe vulnerability occurs due to improper input validation when processing malformed DHCP packets, which can lead to memory corruption within the heap.\nAn attacker who successfully exploits this vulnerability can execute arbitrary code with elevated system-level privileges on the host machine.\nThis flaw is particularly dangerous due to its network-adjacent nature, allowing an attacker to trigger the overflow without requiring prior authentication or user interaction.\nThe impact includes full system compromise, unauthorized data access, and potential lateral movement within the enterprise network.\nDue to the nature of the DHCP protocol, which operates at the Data Link and Network layers, the service is often exposed to any device on the local network segment, increasing the attack surface significantly.",
  "technicalDetails": "The vulnerability resides in the core handling of incoming DHCP packets by the Windows DHCP Server service. Specifically, the flaw is rooted in how the service allocates and manages heap memory during the parsing of packet options or fields.\nWhen the DHCP service receives a specially crafted, malformed packet, the buffer allocation logic fails to correctly calculate the required size or perform adequate boundary checking. This allows an attacker to write data beyond the allocated buffer boundaries on the heap.\nThe exploitation process involves sending a sequence of malicious DHCP packets to the target server. By controlling the contents of the payload, the attacker can overwrite adjacent heap chunks, including metadata such as chunk headers or pointers, or overwrite function pointers stored within objects on the heap.\nOnce the heap metadata or an object's virtual function table is corrupted, the attacker can redirect the execution flow of the DHCP process when the corrupted memory is accessed or deallocated. This redirection allows the attacker to execute arbitrary shellcode injected as part of the malicious DHCP packet payload.\nSince the Windows DHCP Server service typically runs under the context of the SYSTEM account, successful exploitation results in full administrative control over the affected server. The attack does not require any authentication, as the DHCP protocol must process requests from potentially unknown or unauthenticated clients to function correctly.\nThe network exposure is high, as the DHCP service listens on UDP port 67. Any device capable of reaching the server via Layer 2 or Layer 3 can transmit the malicious packet. Because the DHCP service processes requests before any session-level authentication occurs, the vulnerability is reachable by any host on the broadcast domain or through relayed traffic.\nPost-exploitation, an attacker can deploy persistent backdoors, extract sensitive credentials from memory (e.g., LSASS dumping), or leverage the compromised server as a pivot point to conduct reconnaissance and further attacks against the internal network infrastructure."
}