CVE-2026-56159: Windows DHCP Server Buffer Overflow Flaw

CVE-2026-56159 Overview

CVE-2026-56159 is a heap-based buffer overflow [CWE-122] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated attacker can send crafted DHCP traffic over the network to corrupt heap memory and execute arbitrary code in the context of the DHCP Server process. Because the DHCP Server service typically runs with elevated privileges on domain infrastructure, successful exploitation can compromise core network services and provide a foothold for lateral movement.

Critical Impact
Unauthenticated remote code execution against Windows DHCP Server with no user interaction required, threatening the confidentiality, integrity, and availability of affected hosts.

Affected Products

Microsoft Windows Server with the DHCP Server role enabled
Refer to the Microsoft CVE-2026-56159 Update Guide for the authoritative list of affected builds
Domain-joined environments relying on Windows DHCP for IP address assignment

Discovery Timeline

2026-07-14 - CVE-2026-56159 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in the NVD database

Technical Details for CVE-2026-56159

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Windows DHCP Server service. The service parses DHCP client messages received on UDP port 67 and writes attacker-influenced data into a heap buffer without adequate bounds enforcement. Overflowing this buffer corrupts adjacent heap metadata and object pointers used by the service.

An attacker who controls the overflow contents can influence downstream memory operations to achieve arbitrary code execution. Exploitation does not require authentication or user interaction, and the DHCP Server service runs with high privileges, which yields full compromise of the host on successful exploitation.

Root Cause

The root cause is missing or incorrect length validation when the DHCP Server processes fields inside DHCP messages such as options, client identifiers, or vendor-specific data. Input length is trusted from the wire and used to size or index heap buffers, allowing an oversized field to overwrite adjacent heap structures.

Attack Vector

The attack vector is network-based. Any host able to reach UDP port 67 on the DHCP server can transmit malformed DHCPDISCOVER, DHCPREQUEST, or DHCPINFORM packets that trigger the overflow. On flat networks and typical enterprise segments where DHCP broadcasts are permitted, exposure is broad. Attackers on adjacent segments can also reach the service through DHCP relay agents.

See the Microsoft CVE-2026-56159 Update Guide for vendor-provided technical detail.

Detection Methods for CVE-2026-56159

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the DHCPServer service (svchost.exe hosting dhcpssvc.dll)
Malformed DHCP packets with oversized options or vendor-specific fields captured on UDP port 67
New or unexpected child processes spawned from the DHCP Server service host
Outbound network connections originating from the DHCP Server process to non-standard destinations

Detection Strategies

Monitor Windows Event Log channels for DHCP Server service faults, access violations, and unexpected restarts
Inspect DHCP traffic at the network edge and internal segments for option lengths that exceed protocol expectations
Correlate DHCP service crashes with subsequent process creation or authentication activity on the same host

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) on DHCP servers and alert on non-standard child processes of svchost.exe
Forward DHCP server logs and endpoint telemetry to a centralized analytics platform for correlation
Baseline normal DHCP traffic volume and packet structure to surface anomalous option payloads

How to Mitigate CVE-2026-56159

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-56159 Update Guide to all Windows Servers running the DHCP Server role
Inventory all systems with the DHCP Server role enabled, including branch office and disaster-recovery hosts
Restrict UDP port 67 exposure to authorized network segments and DHCP relay agents only

Patch Information

Microsoft has published a security update for CVE-2026-56159. Administrators should consult the Microsoft CVE-2026-56159 Update Guide for the specific KB article, affected builds, and installation guidance, then deploy through Windows Update, WSUS, or the enterprise patch management platform in use.

Workarounds

If patching cannot be performed immediately, restrict inbound DHCP traffic to trusted VLANs using access control lists on switches and firewalls
Where feasible, temporarily migrate DHCP scopes to an unaffected server or appliance until the patch is deployed
Disable the DHCP Server role on hosts that do not require it and validate that no rogue DHCP servers exist on the network

bash

# Identify Windows Servers with the DHCP Server role installed
Get-WindowsFeature -Name DHCP | Where-Object { $_.Installed -eq $true }

# List installed security updates to confirm patch presence
Get-HotFix | Sort-Object -Property InstalledOn -Descending

# Restrict inbound DHCP traffic to authorized relay agents only
New-NetFirewallRule -DisplayName "Restrict DHCP Server Inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 67 `
  -RemoteAddress 10.0.0.0/8 -Action Allow