CVE-2026-49181: Windows 10 Privilege Escalation Flaw

CVE-2026-49181 Overview

CVE-2026-49181 is an integer underflow vulnerability [CWE-191] in the Windows Dynamic Host Configuration Protocol (DHCP) Client. The flaw allows an unauthorized attacker to elevate privileges over a network. Microsoft rates the issue Critical, and the CVSS vector indicates network-based exploitation without authentication or user interaction. The vulnerability affects a broad range of supported Windows client and server releases, including Windows 10, Windows Server 2012, 2016, 2019, 2022, and 2025.

Critical Impact
Unauthenticated network attackers on the same broadcast domain can trigger an integer underflow in the DHCP Client to gain elevated privileges, with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1607, 1809)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019
Microsoft Windows Server 2022 and Windows Server 2025

Discovery Timeline

2026-07-14 - CVE-2026-49181 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49181

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Client service, which processes DHCP messages such as DHCPOFFER, DHCPACK, and DHCPNAK from servers on the local network. An integer underflow occurs when the client parses a malformed field, causing an unsigned length or size calculation to wrap to a very large value. Subsequent memory operations then act on attacker-controlled data using an incorrect size, corrupting adjacent memory.

Because the DHCP Client runs with SYSTEM-level privileges, successful memory corruption can be leveraged to execute attacker code in the local system context. This transforms a network-adjacent parsing bug into a full privilege elevation on the target host.

Root Cause

The root cause is an arithmetic wraparound [CWE-191] during option or field length handling in DHCP message parsing. A crafted option length smaller than an expected header or offset produces a negative result that, interpreted as unsigned, becomes a very large integer used in a subsequent copy or index operation.

Attack Vector

An attacker on the same layer-2 network segment sends a crafted DHCP response to a client soliciting an address, or spoofs a rogue DHCP server. The malformed packet triggers the underflow inside the DHCP Client, allowing code execution as SYSTEM. No authentication or user interaction is required, and the client processes DHCP traffic by default on standard interfaces.

See the Microsoft Security Update Guide for CVE-2026-49181 for vendor technical details.

Detection Methods for CVE-2026-49181

Indicators of Compromise

Unexpected dhcpcore.dll or svchost.exe (hosting the DHCP Client service) crashes recorded in the Windows Application event log or WER reports.
DHCP responses originating from unauthorized MAC or IP addresses within the broadcast domain.
Anomalous DHCP option fields with inconsistent or oversized length values captured in network telemetry.

Detection Strategies

Inspect DHCP traffic for malformed option lengths, truncated messages, and options where the declared length exceeds the remaining packet payload.
Alert on multiple DHCP servers offering leases on a segment where only one authorized server exists.
Correlate DHCP Client service crashes with subsequent SYSTEM-level process creation events to identify post-exploitation activity.

Monitoring Recommendations

Enable DHCP snooping on managed switches to block rogue DHCP responses at the network edge.
Forward Windows System, Application, and Sysmon logs to a central platform to detect crashes and anomalous child processes of svchost.exe.
Baseline authorized DHCP server addresses and alert on deviations in production and user subnets.

How to Mitigate CVE-2026-49181

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-49181 to all affected Windows client and server systems.
Prioritize patching for internet-adjacent hosts, jump servers, and systems located on shared or untrusted network segments.
Audit network segments for rogue DHCP servers and remove any unauthorized devices offering leases.

Patch Information

Microsoft has released fixes through the Security Update Guide. Administrators should deploy the applicable cumulative update for each affected build of Windows 10, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and Windows Server 2025 as listed in the Microsoft advisory.

Workarounds

Enable DHCP snooping and configure trusted ports only on switches that connect to authorized DHCP servers.
Segment untrusted networks so that unmanaged devices cannot reach servers or high-value workstations at layer 2.
Where feasible on servers with static addressing, disable the DHCP Client service to eliminate exposure until patches are applied.

bash

# Example: disable the DHCP Client service on a Windows host with static IP configuration
sc.exe config Dhcp start= disabled
sc.exe stop Dhcp

# Verify the service state
sc.exe query Dhcp