CVE-2025-21179: Windows 11 24H2 DHCP Client DOS Vulnerability

CVE-2025-21179 Overview

CVE-2025-21179 is a denial of service vulnerability in the Microsoft Windows Dynamic Host Configuration Protocol (DHCP) Client Service. The flaw affects Windows 11 24H2 and Windows Server 2025. Microsoft classifies the issue with a medium severity rating tied to an out-of-bounds read condition tracked under [CWE-125].

Exploitation requires an attacker on an adjacent network segment and user interaction, which raises the attack complexity. A successful attack disrupts availability of the DHCP client, preventing affected hosts from obtaining or renewing network configuration.

Critical Impact
Successful exploitation halts the DHCP Client Service on Windows 11 24H2 and Windows Server 2025, disrupting network connectivity for affected systems until the service or host is restored.

Affected Products

Microsoft Windows 11 version 24H2
Microsoft Windows Server 2025 (x64)
Systems running the built-in Windows DHCP Client Service

Discovery Timeline

2025-02-11 - CVE-2025-21179 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21179

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Client Service, the component responsible for negotiating IP address leases and network parameters from DHCP servers. An out-of-bounds read [CWE-125] occurs when the service processes a specifically crafted DHCP response.

An attacker must be on an adjacent network to inject or spoof DHCP traffic that reaches the target. Additional user interaction is also required, which narrows the practical exploitation surface. The impact is limited to availability, with no confidentiality or integrity consequences per the published vector.

Because the DHCP Client Service is essential for automatic network configuration, a crash cascades into loss of network connectivity. Hosts holding an active lease may continue to operate until renewal, at which point service disruption becomes visible.

Root Cause

The root cause is an out-of-bounds read in the DHCP client parsing logic. The service reads beyond an allocated buffer while handling malformed option fields in a DHCP message, which leads to a memory access fault and a service crash.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reside on the same broadcast domain or link-local segment as the target. The attacker delivers a crafted DHCP packet that triggers the out-of-bounds read during option processing. Because DHCP relies on broadcast and multicast traffic within a subnet, an attacker with a rogue device on the same VLAN can reach vulnerable clients.

See the Microsoft Security Update CVE-2025-21179 advisory for authoritative technical details.

Detection Methods for CVE-2025-21179

Indicators of Compromise

Unexpected termination or repeated crashes of the dhcpcore.dll-hosted DHCP Client Service (Dhcp) in the Service Control Manager
Application or System event log entries indicating a fault in svchost.exe hosting the DHCP client
Sudden loss of IPv4 addressing across multiple hosts on the same subnet without corresponding network changes

Detection Strategies

Monitor Windows event logs for Service Control Manager events 7031/7034 referencing the DHCP Client Service
Inspect network traffic for anomalous DHCP OFFER or ACK messages containing malformed or oversized option fields
Correlate DHCP lease acquisition failures across endpoints on the same VLAN to identify potential rogue DHCP activity

Monitoring Recommendations

Baseline authorized DHCP servers per subnet and alert on responses originating from unknown MAC or IP addresses
Forward Windows service crash telemetry to a centralized SIEM for correlation with DHCP anomalies
Enable DHCP snooping on managed switches to constrain which ports may source DHCP server responses

How to Mitigate CVE-2025-21179

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-21179 advisory to all Windows 11 24H2 and Windows Server 2025 hosts
Inventory endpoints running the affected builds and prioritize patching for systems on shared or untrusted network segments
Validate that DHCP snooping and port security controls are enforced on access switches

Patch Information

Microsoft addressed CVE-2025-21179 in the February 2025 security update cycle. Refer to the Microsoft Security Update CVE-2025-21179 advisory for the specific KB articles applicable to Windows 11 24H2 and Windows Server 2025.

Workarounds

Enable DHCP snooping on network switches to block unauthorized DHCP responses at Layer 2
Segment untrusted devices onto isolated VLANs to reduce adjacent-network exposure
Where feasible, assign static IP configuration to critical servers to reduce reliance on the DHCP Client Service until patching is complete

bash

# Example: enable DHCP snooping on a Cisco IOS switch
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
interface GigabitEthernet1/0/1
 ip dhcp snooping trust
end
write memory