CVE-2024-26202: Windows Server 2012 DHCP RCE Vulnerability

CVE-2024-26202 Overview

CVE-2024-26202 is a remote code execution vulnerability affecting the Microsoft Windows DHCP Server Service. The flaw is categorized under [CWE-122] (Heap-based Buffer Overflow) and permits an authenticated attacker with high privileges to execute arbitrary code on a vulnerable server across the network. Microsoft published the advisory on April 9, 2024. Successful exploitation compromises confidentiality, integrity, and availability of the affected host. The vulnerability carries an EPSS probability of 2.217%, placing it in the 80.998 percentile of exploitation likelihood.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the DHCP Server Service, enabling attackers to pivot within Windows Server environments where DHCP is a foundational network service.

Affected Products

Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016 and Windows Server 2019
Microsoft Windows Server 2022 and Windows Server 2022 23H2

Discovery Timeline

2024-04-09 - CVE-2024-26202 published to NVD
2024-04-09 - Microsoft releases security update via the Microsoft Security Update Guide
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26202

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server Service, a network protocol service that assigns IP addresses and configuration parameters to clients. An attacker with high privileges on the network can send crafted DHCP messages that trigger a heap-based buffer overflow in the service process. Successful exploitation leads to arbitrary code execution within the service context. Because DHCP servers typically operate on domain-joined infrastructure, code execution on the server provides a foothold with significant lateral movement potential. The CWE-122 classification indicates the overflow occurs on the heap, where memory allocations for DHCP options and lease structures are managed.

Root Cause

The root cause is improper validation of size or bounds when the DHCP Server Service processes attacker-influenced input. This condition allows data to be written outside the intended heap allocation. Corruption of adjacent heap structures, including function pointers or object metadata, enables control-flow hijacking.

Attack Vector

Exploitation requires network access to the DHCP Server Service and authenticated high-privilege access to prepare or send the malicious request. No user interaction is required. The attacker leverages the network-reachable DHCP service to deliver the crafted payload and trigger the memory corruption. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2024-26202

Indicators of Compromise

Unexpected crashes or restarts of the DHCPServer service (dhcpserver.dll hosted under svchost.exe) recorded in the System event log.
Anomalous child processes spawned from svchost.exe instances that host the DHCP Server Service, particularly command shells or scripting hosts.
Outbound network connections initiated from a DHCP server to unfamiliar or attacker-controlled infrastructure.

Detection Strategies

Monitor Windows Event Log sources Microsoft-Windows-DHCP-Server and Application Error for repeated faults referencing the DHCP service.
Alert on process creation events (Event ID 4688 / Sysmon Event ID 1) where the parent is a DHCP-hosting svchost.exe and the child is an interactive or scripting binary.
Correlate authentication anomalies on DHCP servers with subsequent service crashes to identify pre-exploit reconnaissance.

Monitoring Recommendations

Enable command-line auditing and Sysmon on all Windows Server systems running the DHCP Server role.
Forward DHCP server telemetry and process creation events to a centralized SIEM for correlation.
Baseline normal DHCP process behavior so anomalous memory faults and outbound connections stand out.

How to Mitigate CVE-2024-26202

Immediate Actions Required

Apply the April 2024 Microsoft security update for each affected Windows Server version listed in the Microsoft Security Update Guide.
Inventory all servers running the DHCP Server role and prioritize patching on domain-adjacent and production infrastructure.
Restrict administrative access to DHCP servers and rotate credentials for accounts with high privileges on those systems.

Patch Information

Microsoft addressed CVE-2024-26202 in cumulative security updates released April 9, 2024, for Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2. Consult the Microsoft Security Update Guide for the specific KB article and package that corresponds to each Windows Server build.

Workarounds

Segment DHCP servers on management VLANs and restrict administrative RPC and SMB access to trusted hosts only.
Enforce least privilege on DHCP administrator groups to reduce the pool of accounts capable of triggering the vulnerable code path.
Where feasible, temporarily relocate the DHCP role to patched hosts until legacy systems can be updated.

bash

# Verify DHCP Server role and installed updates on Windows Server
Get-WindowsFeature -Name DHCP
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20