A heap-based buffer overflow vulnerability in the Windows DHCP Server, rated at 8.8 (High), permits an authenticated attacker to execute arbitrary code on the host system.

The flaw is a heap-based buffer overflow (CWE-122) within the Windows DHCP Server component. An attacker with authorized (authenticated) network access can trigger this overflow to execute code with elevated privileges.

Successful exploitation of this vulnerability allows an authenticated attacker to gain full control over the affected DHCP server. Given the CVSS score of 8.8, this poses a significant risk to organizational infrastructure, as the DHCP service is a core networking component. Compromise of this service could lead to lateral movement, unauthorized access to sensitive network traffic, and potential service disruption across the entire local network.

Immediate Action: Apply the September 2026 security updates provided by Microsoft for the specific versions of Windows 10 and Windows Server listed in the enrichment data.

Proactive Monitoring: Monitor system logs for unusual DHCP service crashes or unexpected process executions originating from the DHCP server account.

Compensating Controls: Restrict access to the DHCP service to known, trusted administrative segments to reduce the attack surface for unauthorized or compromised internal accounts.

Public Exploit Available: Unknown.

This vulnerability presents a high risk due to the potential for remote code execution within a critical network service. Administrators should prioritize the deployment of the vendor-supplied security patches to all affected Windows Server and Windows 10 endpoints. Immediate patching is the most effective way to eliminate the risk of exploitation by internal threat actors.