CVE-2026-48564 Overview
CVE-2026-48564 is a heap-based buffer overflow in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An authorized attacker can trigger the flaw over the network to execute arbitrary code in the context of the DHCP Server process. The weakness maps to [CWE-122], heap-based buffer overflow, and affects supported Windows client and server releases that ship the DHCP Server role.
Microsoft published the advisory on 2026-07-14 and rated the issue as high severity with a CVSS 3.1 base score of 8.8. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.
Critical Impact
An authenticated attacker with network access to a Windows DHCP Server can execute code in the DHCP service context, which typically runs with elevated privileges on domain-connected infrastructure.
Affected Products
- Microsoft Windows 10 versions 1607 and 1809 (x64 and x86)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019
- Microsoft Windows Server 2022 and Windows Server 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-48564 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Microsoft publishes the Microsoft CVE-2026-48564 Advisory
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-48564
Vulnerability Analysis
The flaw exists in the Windows DHCP Server service, which handles address assignment and option parsing for DHCPv4 and DHCPv6 clients. A malformed DHCP message causes the server to write beyond the bounds of a heap-allocated buffer. Because the DHCP Server service runs with high privileges on Windows Server, memory corruption in this component can lead to full system compromise.
The attack vector is network-based with low attack complexity, and it requires low-privileged authentication. User interaction is not required, and successful exploitation impacts confidentiality, integrity, and availability. The EPSS model estimates a 0.763% probability of exploitation within 30 days.
Root Cause
The root cause is improper validation of length or offset fields during processing of DHCP request or option data. The service allocates a heap buffer sized against one input value and then copies data governed by a separate, attacker-controlled value. This mismatch permits writes past the end of the allocation, corrupting adjacent heap metadata or function pointers.
Attack Vector
An attacker with valid credentials on the network sends a crafted DHCP message to a vulnerable server. The malformed packet triggers the overflow inside the DHCP Server process, allowing the attacker to overwrite heap-resident structures. From there, the attacker can pivot control flow into arbitrary code executed by the service. No user interaction is required at the target.
A public proof of concept is not currently available. Microsoft has not reported active exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-48564
Indicators of Compromise
- Unexpected crashes, restarts, or Windows Error Reporting entries for the DHCPServer service (dhcpssvc.dll).
- New or unusual child processes spawned by svchost.exe hosting the DHCP Server service.
- DHCP packets with malformed option length fields or oversized vendor-specific options arriving at the server.
- Outbound network connections initiated from the DHCP Server host to untrusted destinations shortly after receiving DHCP traffic.
Detection Strategies
- Monitor Windows Event Log channels Microsoft-Windows-DHCP-Server/Operational and System for repeated service faults or audit failures tied to DHCP.
- Deploy network sensors that inspect DHCP option fields and flag oversized, truncated, or non-standard option encodings.
- Correlate DHCP service crashes with process creation events (Event ID 4688 or Sysmon Event ID 1) originating from the DHCP host.
Monitoring Recommendations
- Baseline normal DHCP traffic volume and option composition, then alert on statistical deviations from authenticated subnets.
- Enable command-line auditing and PowerShell logging on DHCP servers to capture post-exploitation activity.
- Forward DHCP server telemetry to a centralized SIEM or data lake for cross-host correlation with authentication and lateral movement events.
How to Mitigate CVE-2026-48564
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-48564 Advisory to all affected Windows Server and Windows 10 hosts running the DHCP Server role.
- Inventory hosts with the DHCP Server role enabled using Get-WindowsFeature DHCP and prioritize domain-joined servers.
- Restrict management and client access to DHCP servers to trusted, authenticated network segments.
- Rotate credentials that could have been exposed on any DHCP host suspected of compromise.
Patch Information
Microsoft has released fixes for all listed products through the standard monthly update channel. Consult the Microsoft CVE-2026-48564 Advisory for the KB article and update package that corresponds to each Windows build. Install the update on every DHCP Server, including cluster and failover partners, and reboot to load the patched dhcpssvc.dll.
Workarounds
- Where patching is delayed, isolate DHCP servers behind network access controls that permit DHCP traffic only from expected client VLANs.
- Disable the DHCP Server role on hosts that do not require it using Uninstall-WindowsFeature DHCP.
- Enforce DHCP snooping and rate limiting on network switches to block spoofed or malformed DHCP packets from reaching servers.
# Configuration example: verify and remove the DHCP Server role on hosts that do not require it
Get-WindowsFeature -Name DHCP
Uninstall-WindowsFeature -Name DHCP -Restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
