CVE-2026-45634: Windows DHCP Server Information Disclosure

CVE-2026-45634 Overview

CVE-2026-45634 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server. An authorized local attacker can exploit the flaw to read memory outside the intended buffer and disclose sensitive information. Microsoft documents the issue in its Microsoft Security Update CVE-2026-45634 advisory.

The vulnerability requires local access and low-privilege authentication. It affects confidentiality only, without impact to integrity or availability. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
An authenticated local attacker can disclose memory contents from the Windows DHCP Server process, potentially exposing configuration data, credentials, or other sensitive information held in service memory.

Affected Products

Windows DHCP Server (specific Windows Server versions enumerated in the Microsoft advisory)

Discovery Timeline

2026-06-09 - CVE-2026-45634 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45634

Vulnerability Analysis

The flaw is an out-of-bounds read in the Windows DHCP Server service. The service reads memory past the bounds of an allocated buffer when processing certain data structures. This exposes adjacent process memory to the caller.

Out-of-bounds read flaws classified under [CWE-125] commonly stem from missing length validation. The disclosed memory can include heap metadata, lease records, configuration values, or fragments of other DHCP transactions. Disclosed contents may aid follow-on attacks against the host or domain environment.

The attack vector is local, meaning the attacker must already have execution context on the affected server. Required privileges are low, but interaction with the DHCP Server service is necessary to trigger the unsafe read path.

Root Cause

The root cause is improper validation of input length or index boundaries within a DHCP Server parsing or lookup routine. When a crafted request or local IPC call references a buffer offset beyond the allocated region, the service returns the out-of-range bytes instead of rejecting the operation.

Attack Vector

Exploitation requires a local authenticated session on the Windows Server host running the DHCP role. The attacker interacts with the DHCP Server through a supported interface and submits crafted input that triggers the vulnerable read. The server returns memory contents that the attacker then captures for analysis. No user interaction is required, and the attack does not cross a privilege boundary at the system level.

Refer to the Microsoft Security Update CVE-2026-45634 advisory for the precise interface and payload conditions.

Detection Methods for CVE-2026-45634

Indicators of Compromise

Unexpected local processes interacting with the DHCP Server service (dhcpserver) on domain controllers or member servers hosting the DHCP role.
Anomalous read patterns or repeated malformed requests directed at the DHCP Server from low-privilege local accounts.
New or unusual user sessions on DHCP Server hosts that lack a documented administrative justification.

Detection Strategies

Monitor process creation and module loads associated with dhcpserver.exe and surrounding RPC interfaces for unexpected callers.
Correlate local logon events (Event ID 4624 type 2 or 10) on DHCP servers with subsequent DHCP service activity from non-administrative accounts.
Hunt for repeated service crashes or error events generated by the DHCP Server, which can indicate fuzzing or exploitation attempts.

Monitoring Recommendations

Forward Windows Security, System, and DHCP Server operational logs to a centralized SIEM for retention and correlation.
Baseline normal local access to DHCP servers and alert on deviations, including non-admin shell activity.
Track patch state across all Windows Server hosts with the DHCP role to ensure the fix is deployed.

How to Mitigate CVE-2026-45634

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45634 advisory to all Windows Server hosts running the DHCP role.
Restrict local logon rights on DHCP servers to administrators and required service accounts only.
Review and rotate any credentials or secrets that may have been stored in DHCP Server memory if compromise is suspected.

Patch Information

Microsoft has issued a security update for this vulnerability. Consult the Microsoft Security Update CVE-2026-45634 advisory for the specific KB articles, build numbers, and supported Windows Server versions.

Workarounds

Limit interactive and remote desktop access to DHCP servers using Group Policy and Just Enough Administration (JEA).
Segment DHCP server hosts so they do not run additional roles that could expose more local users to the service.
Enable enhanced auditing on DHCP servers to capture process and logon activity until the patch is deployed.

bash

# Configuration example: query DHCP Server patch state on Windows Server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-WindowsFeature -Name DHCP
Get-Service -Name DHCPServer | Select-Object Status, StartType