CVE-2026-45608 Overview
CVE-2026-45608 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server. The flaw allows an authorized attacker with local access to disclose information from process memory. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).
The vulnerability carries a CVSS 3.1 score of 6.8 with a local attack vector. While exploitation requires local access, the impact extends to high availability disruption alongside limited confidentiality disclosure. No public proof-of-concept exists, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
An authorized local attacker can read memory contents beyond intended buffer boundaries in the Windows DHCP Server service, leading to information disclosure and potential service disruption.
Affected Products
- Windows DHCP Server (specific build versions per Microsoft advisory)
- Windows Server editions running the DHCP Server role
- Refer to the Microsoft Vulnerability Advisory CVE-2026-45608 for the authoritative list of affected builds
Discovery Timeline
- 2026-06-09 - CVE-2026-45608 published to the National Vulnerability Database
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45608
Vulnerability Analysis
The vulnerability is classified as an out-of-bounds read [CWE-125] in the Windows DHCP Server component. An out-of-bounds read occurs when the service reads data past the end, or before the beginning, of an allocated buffer. The DHCP Server service processes lease records, option fields, and client message structures that have variable lengths.
When the parsing logic fails to validate length fields against buffer boundaries, the service can read adjacent memory. This memory may contain sensitive data such as authentication material, configuration secrets, or pointers useful for further exploitation. The vulnerability also affects availability, which suggests crafted input can cause the DHCP service process to terminate or hang.
Root Cause
The root cause is missing or insufficient bounds checking when the Windows DHCP Server parses attacker-influenced data structures. Detailed technical specifics, including affected functions and exact data structures, are not publicly disclosed by Microsoft to limit exploitation risk before patches are widely deployed.
Attack Vector
Exploitation requires local access (AV:L) and no privileges (PR:N), with no user interaction. An attacker authorized to interact with the DHCP Server process locally — for example, through inter-process communication channels, management interfaces, or local API calls — can supply crafted input that triggers the out-of-bounds read. Successful exploitation reveals limited confidentiality information and can crash the DHCP service.
No verified exploit code is publicly available. The vulnerability mechanism is described in prose because no proof-of-concept has been released. See the Microsoft Vulnerability Advisory CVE-2026-45608 for vendor-supplied technical context.
Detection Methods for CVE-2026-45608
Indicators of Compromise
- Unexpected crashes or restarts of the DHCPServer service (dhcpserver.exe) recorded in the System event log
- Windows Error Reporting entries referencing the DHCP Server process with access violation exception codes
- Anomalous local process activity interacting with DHCP Server management APIs or RPC endpoints
Detection Strategies
- Monitor Windows event IDs related to service crashes (Service Control Manager events 7031, 7034) for the DHCP Server service
- Correlate local logon activity with subsequent DHCP service instability to identify potential exploitation attempts
- Enable Windows Defender Application Control or AppLocker logging to track unauthorized local processes invoking DHCP management interfaces
Monitoring Recommendations
- Forward DHCP Server operational and admin event logs to a centralized logging platform for retention and analysis
- Baseline normal DHCP service memory usage and crash frequency to detect statistical anomalies
- Track local privilege use against DHCP-related RPC interfaces and management tools such as netsh dhcp and Dhcpmgmt.msc
How to Mitigate CVE-2026-45608
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-45608 on all Windows Servers running the DHCP Server role
- Inventory all DHCP Server instances across the environment to confirm patch coverage
- Restrict local interactive and remote desktop access to DHCP servers to administrators only
Patch Information
Microsoft has published a security update for CVE-2026-45608. Administrators should consult the Microsoft Vulnerability Advisory CVE-2026-45608 for the specific Knowledge Base (KB) article numbers corresponding to each affected Windows Server build, and deploy through Windows Update, WSUS, or the Microsoft Update Catalog.
Workarounds
- Limit local accounts on DHCP servers and enforce least privilege for any account permitted to log on locally
- Where DHCP Server is not required, remove the role using Uninstall-WindowsFeature DHCP to eliminate the attack surface
- Segment DHCP servers into restricted administrative tiers consistent with Microsoft's tiered administration model
# Verify installed updates on a Windows DHCP Server
Get-HotFix | Sort-Object -Property InstalledOn -Descending
# Check DHCP service status
Get-Service -Name DHCPServer
# Remove the DHCP Server role if not needed
Uninstall-WindowsFeature -Name DHCP -Restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
