CVE-2026-62823 – Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-62823 is a critical heap-based buffer overflow vulnerability in Windows DHCP Server. An unauthenticated attacker on an adjacent network can send a specially crafted packet to an affected service and potentially execute code on the target system. The attack requires low complexity, no privileges, and no user interaction.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
An attacker with adjacent network access could target the Windows DHCP Server service with a malicious packet. Successful exploitation could compromise confidentiality, integrity, and availability, with each rated High in the CVSS metrics.

EXPLOITS:
This vulnerability was not publicly disclosed and was not known to be exploited at publication. Exploit code maturity is Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows DHCP Server. An unauthenticated attacker can send a specially crafted packet to an affected service over an adjacent network. Because attack complexity is Low and neither privileges nor user interaction are required, successful exploitation could allow the attacker to execute code on the target system. The vulnerability has High potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires an attacker to send a specially crafted packet from an adjacent network to an affected service.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on systems running the affected DHCP service. This creates the potential for system compromise, unauthorized access to sensitive information, modification of system resources, and disruption of service. Compromise of infrastructure providing DHCP services could also create significant operational risk.

WORKAROUND:
No mitigation or workaround is identified. An official fix is available, so affected systems should be updated where possible.

URGENCY:
This vulnerability is rated Critical and exploitation is assessed as More Likely. Its combination of low attack complexity, no required privileges, no user interaction, and potential remote code execution makes prompt deployment important, particularly on systems exposing affected DHCP services to adjacent networks.