CVE-2026-61361 Overview
CVE-2026-61361 is a use-after-free vulnerability [CWE-416] in the Windows Dynamic Host Configuration Protocol (DHCP) Client component. An authorized local attacker can exploit the flaw to execute arbitrary code with elevated privileges. Microsoft published the advisory on August 11, 2026, and the issue affects Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2025 across x64 and ARM64 architectures. Successful exploitation compromises the confidentiality, integrity, and availability of the affected host. Exploitation requires local access and low privileges, but attack complexity is high due to timing conditions inherent to use-after-free primitives.
Critical Impact
Local authorized attackers can achieve code execution on Windows 11 and Windows Server 2025 systems through a use-after-free condition in the DHCP Client service.
Affected Products
- Microsoft Windows 11 24H2 (x64, ARM64)
- Microsoft Windows 11 25H2 (x64, ARM64)
- Microsoft Windows 11 26H1 (x64, ARM64)
- Microsoft Windows Server 2025 (x64)
Discovery Timeline
- 2026-08-11 - CVE-2026-61361 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61361
Vulnerability Analysis
The vulnerability resides in the Windows DHCP Client service, which manages the acquisition and renewal of IP configuration data from DHCP servers. A use-after-free condition [CWE-416] occurs when the service references memory that has already been released. An authorized local attacker who wins the required race can reclaim the freed allocation with attacker-controlled data. Subsequent dereferences by the DHCP Client then operate on the crafted object, enabling arbitrary code execution in the security context of the service.
Because the DHCP Client runs with elevated system privileges, successful exploitation results in a privilege escalation from a standard authenticated user to code execution within a system service. Full technical specifics are limited in the public advisory; Microsoft has not released proof-of-concept code, and no exploitation in the wild has been reported.
Root Cause
The root cause is improper lifetime management of a heap object within the DHCP Client. Concurrent operations release an object while another code path retains and later uses a pointer to that memory. The absence of synchronization or reference counting allows the freed region to be reallocated before reuse.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. The attacker must trigger the vulnerable code path in the DHCP Client and reliably reclaim the freed allocation before the stale pointer is dereferenced. High attack complexity reflects the timing precision required to win the race consistently.
No verified public exploit code exists at the time of publication. See the Microsoft Security Update CVE-2026-61361 advisory for vendor guidance.
Detection Methods for CVE-2026-61361
Indicators of Compromise
- Unexpected crashes or restarts of the Dhcp service (svchost.exe hosting dhcpcore.dll) recorded in the System event log.
- Windows Error Reporting (WER) entries referencing access violations inside dhcpcore.dll or related DHCP client modules.
- Anomalous child processes spawned from the svchost.exe instance hosting the DHCP Client service.
Detection Strategies
- Monitor for process creation events where the parent is the DHCP Client svchost.exe and the child is an interactive shell such as cmd.exe or powershell.exe.
- Alert on repeated DHCP Client service crashes, which can indicate failed exploitation attempts against the use-after-free condition.
- Correlate local logon events with subsequent DHCP service anomalies to surface attempts at privilege escalation from standard user accounts.
Monitoring Recommendations
- Enable and forward Sysmon Event IDs 1 (process create), 10 (process access), and 11 (file create) targeting DHCP service processes.
- Aggregate Windows Error Reporting telemetry centrally and baseline normal DHCP Client fault rates.
- Track patch deployment status for KB updates addressing CVE-2026-61361 across all Windows 11 and Windows Server 2025 endpoints.
How to Mitigate CVE-2026-61361
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-61361 to all affected Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 systems.
- Prioritize patching on multi-user systems, terminal servers, and virtual desktop infrastructure where local authenticated users are more prevalent.
- Audit local account membership and remove unnecessary interactive logon rights to reduce the pool of potential attackers.
Patch Information
Microsoft released a security update for CVE-2026-61361 through the standard Windows Update channel. Refer to the Microsoft Security Update CVE-2026-61361 guidance for the specific KB article and build numbers corresponding to each affected Windows version.
Workarounds
- No vendor-supplied workaround is documented; patching is the only supported remediation.
- Where patching must be delayed, restrict local logon to trusted administrators and enforce application allowlisting to limit the tools available to a local attacker.
- Disabling the DHCP Client service is not a viable workaround on hosts that rely on dynamic IP configuration.
# Verify patch installation status on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Check DHCP Client service state
Get-Service -Name Dhcp | Format-List Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
