CVE-2026-88171 – Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-88171 is a Critical Remote Code Execution (RCE) vulnerability affecting Windows DHCP Server across multiple versions of Windows Server and Windows 10. The vulnerability originates from a double-free memory management issue that could allow an unauthenticated attacker to execute malicious code remotely over a network. Successful exploitation requires winning a race condition, making attacks more complex. However, the vulnerability remains dangerous because attackers do not need authentication or user interaction. Microsoft has released security updates to address this issue. Although exploitation is considered less likely, organizations should prioritize patching affected systems to prevent potential compromise.

CVSS SCORE: 8.1

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk to organizations running affected Windows DHCP Server installations.

An attacker could potentially exploit the vulnerability remotely without requiring valid credentials or any action from a legitimate user.

Successful exploitation could result in:

• Remote Code Execution: Attackers could execute malicious code on vulnerable systems.
• Unauthorized System Access: Attackers could potentially gain control over compromised servers.
• Data Compromise: Sensitive business information could be exposed, modified, or stolen.
• Service Disruption: Compromised DHCP infrastructure could affect network connectivity and business operations.
• Operational Impact: Organizations could experience downtime, recovery costs, and disruption to critical services.

The vulnerability has a network-based attack vector and carries High impact ratings for confidentiality, integrity, and availability.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability was not publicly disclosed and was not known to be actively exploited at the time of publication.

The exploit code maturity is classified as Unproven, meaning the existence of reliable public exploit code or proof-of-concept (PoC) exploitation has not been confirmed.

There is no confirmed evidence of active zero-day exploitation.

However, exploitation remains technically possible because attackers can target the vulnerability remotely without authentication.

The main challenge for attackers is the requirement to successfully win a race condition, which increases attack complexity and reduces the likelihood of successful exploitation.

Technical Summary

CVE-2026-88171 is a Remote Code Execution vulnerability caused by a Double Free (CWE-415) weakness in Windows DHCP Server.

A double-free vulnerability occurs when software attempts to release the same allocated memory more than once.

This improper memory management can corrupt the application’s memory structures and potentially create conditions that allow an attacker to execute unauthorized code.

In this case, the vulnerability affects Windows DHCP Server and can be exploited through a network-based attack.

The vulnerability has several important technical characteristics:

• Attack Vector: Network (AV:N), allowing remote exploitation.
• Attack Complexity: High (AC:H), requiring specific conditions for successful exploitation.
• Privileges Required: None (PR:N), meaning attackers do not need valid credentials.
• User Interaction: None (UI:N), meaning exploitation does not require a user to open a file, click a link, or perform another action.
• Scope: Unchanged (S:U).
• Confidentiality Impact: High.
• Integrity Impact: High.
• Availability Impact: High.

A key technical challenge is the requirement for an attacker to win a race condition.

A race condition occurs when the outcome of an operation depends on the timing or sequence of events.

For successful exploitation, attackers must trigger the vulnerable memory-management behavior under the required timing conditions.

Although this makes exploitation more difficult, it does not eliminate the possibility of remote code execution.

If successfully exploited, the vulnerability could allow an unauthorized attacker to execute code on the affected system, potentially compromising its confidentiality, integrity, and availability.

Microsoft has released an official security fix to address this vulnerability.

Exploitability

The vulnerability affects the following Microsoft products:

• Windows Server 2025 – KB5126646
• Windows Server 2022 – KB5126655
• Windows Server 2019 – KB5126651
• Windows Server 2016 – KB5126868
• Windows Server 2012 R2 – KB5126836
• Windows Server 2012 – KB5126835
• Windows 10 Version 1809 – KB5126651
• Windows 10 Version 1607 – KB5126868

Both standard and Server Core installations are affected for the listed Windows Server versions.

For Windows 10, both 32-bit and x64-based systems are affected.

An unauthenticated attacker could exploit the double-free vulnerability remotely over a network by successfully triggering the required race condition.

Microsoft rates exploitation as Less Likely, primarily because of the high attack complexity.

Business Impact

This vulnerability could have serious consequences for organizations that depend on Windows DHCP Server for network operations.

DHCP infrastructure plays an important role in assigning network configuration information to connected devices. A compromised DHCP server could therefore create significant operational risks.

Potential business impacts include:

• Critical Infrastructure Compromise: Successful exploitation could allow attackers to execute malicious code on important network servers.
• Network Service Disruption: A compromised or unavailable DHCP server could interrupt network connectivity for employees and business systems.
• Sensitive Data Exposure: Attackers could potentially access confidential business information stored on or accessible through compromised systems.
• Operational Downtime: Security incidents involving DHCP infrastructure could affect productivity and interrupt essential business services.
• Financial Losses: Incident response, system recovery, and business interruption could generate additional costs.
• Security and Compliance Risks: Unauthorized access and potential data compromise could expose organizations to regulatory and reputational consequences.

The biggest concern is that an attacker does not need credentials or user interaction to attempt exploitation.

Although the attack requires precise timing, successful exploitation could turn an essential network service into a serious security weakness.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

The recommended action is to install the applicable Microsoft security update.

Organizations should prioritize patch deployment on affected systems running Windows DHCP Server.

A system restart is required after installing the applicable security update.

Urgency

Critical – Prioritize deployment of the security update.

CVE-2026-88171 requires priority attention because it combines remote code execution with an attack path that does not require authentication or user interaction.

Although Microsoft considers exploitation less likely and no active exploitation has been confirmed, the potential consequences of a successful attack remain significant.

A compromised DHCP server could affect network availability, expose sensitive information, and disrupt essential business operations.

Organizations should prioritize patching affected Windows DHCP Server installations, particularly those supporting critical business infrastructure.

The absence of known exploitation does not eliminate the risk. A successful attack could compromise an essential network service and create widespread operational disruption.

Deploying the official Microsoft security updates will address the vulnerability and reduce exposure to potential attacks.