Description

Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:20:24.310Z",
  "pubdate": "2026-09-08T18:20:24.310Z",
  "executiveSummary": "A critical memory corruption vulnerability exists within the Windows DHCP Server service, specifically classified as a Use-After-Free (UAF) flaw.\nThe vulnerability allows an unauthorized, remote attacker to trigger arbitrary code execution within the context of the DHCP service.\nSuccessful exploitation compromises the integrity, availability, and confidentiality of the affected Windows DHCP Server instance.\nThis flaw is particularly severe as it resides in a core networking service, potentially allowing for network-level exploitation without prior authentication.\nThe root cause stems from improper management of object lifecycles in memory, leading to a dangling pointer that can be leveraged to redirect execution flow.\nAttackers can leverage this vulnerability to gain elevated privileges on the target system, potentially facilitating lateral movement across the internal network infrastructure.\nNo user interaction is explicitly required for successful exploitation, making it a high-risk target for automated network-based worms or targeted exploitation campaigns.\nSystem administrators are urged to prioritize network segmentation and apply relevant security updates as soon as they become available from the vendor.",
  "technicalDetails": "The vulnerability is a Use-After-Free (UAF) condition residing in the Windows DHCP Server's packet parsing or state-machine handling logic.\nA UAF occurs when an application continues to use a pointer after the memory it references has been deallocated (freed) by the heap manager.\nIn the context of the Windows DHCP Server, the service likely allocates an object to track client sessions or packet states. If a specific sequence of DHCP packets is sent that triggers an error condition or an out-of-order state transition, the application may free the associated memory object while retaining a dangling pointer in the object tracking table or a global structure.\nThe attack flow initiates when the attacker transmits specially crafted DHCP packets to the target server. By manipulating these packets, the attacker forces the service to free the object prematurely. Subsequently, the attacker sends another set of crafted packets designed to trigger the use of that same dangling pointer.\nIf the attacker can 'heap spray' or manipulate the heap layout to place malicious data at the address previously occupied by the freed object, they can control the contents of the memory being accessed by the dangling pointer.\nWhen the DHCP service attempts to perform an operation (such as a virtual function call or member access) using the dangling pointer, it inadvertently executes code or operates on data controlled by the attacker.\nBecause the DHCP Server service typically runs with high-level system privileges (e.g., SYSTEM or a dedicated service account), successful exploitation grants the attacker full control over the process, allowing for the execution of arbitrary payloads, installation of backdoors, or extraction of sensitive configuration data.\nThe exploitation process requires deep knowledge of the Windows heap management system and the specific internal structure of the DHCP service. However, because DHCP is a protocol designed to be accessible to any client on the network, the attack surface is wide, as the service must process inputs from untrusted sources before full authentication or authorization is established.\nThe impact is significant, as the DHCP server is a foundational component of enterprise networking. A successful exploit can lead to a full system compromise, providing the attacker with a stable foothold within the network to facilitate further exploitation of domain controllers or other critical infrastructure."
}