CVE-2026-62714: Windows DHCP Server Information Disclosure

CVE-2026-62714 Overview

CVE-2026-62714 is an integer underflow vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. The flaw allows an unauthorized attacker on an adjacent network to disclose sensitive information from the affected service. The vulnerability is classified under [CWE-125] Out-of-bounds Read, triggered by arithmetic wraparound during DHCP message processing.

Microsoft published the advisory on August 11, 2026. No public proof-of-concept exploit exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires network adjacency, which limits remote attack surface but remains relevant for enterprise LAN and Wi-Fi environments where DHCP servers listen for broadcast traffic.

Critical Impact
An adjacent-network attacker can trigger an integer underflow in the Windows DHCP Server to read out-of-bounds memory and disclose confidential server data without authentication.

Affected Products

Windows DHCP Server (specific supported versions listed in the Microsoft Security Response Center advisory)
Windows Server deployments running the DHCP Server role
Refer to the Microsoft CVE-2026-62714 Update Guide for the authoritative product matrix

Discovery Timeline

2026-08-11 - CVE-2026-62714 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-62714

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes DHCP messages from clients on the local broadcast domain. A malformed DHCP request causes an unsigned integer calculation to wrap below zero. The wrapped value is then used as a length or offset in a subsequent read operation.

Because the calculation feeds into a memory read, the service returns bytes from outside the intended buffer. The disclosed memory can contain lease data, internal configuration state, or heap contents adjacent to DHCP parsing structures. The confidentiality impact is high, while integrity and availability are unaffected.

Exploitation does not require authentication or user interaction. However, the attacker must be positioned on an adjacent network segment, such as the same VLAN, Wi-Fi network, or broadcast domain as the target DHCP server.

Root Cause

The root cause is unchecked arithmetic on a length or size field derived from attacker-controlled DHCP option data. When the parser subtracts a header or offset value from a smaller supplied length, the unsigned result underflows to a large positive value. That value drives a subsequent buffer read past the allocated region, producing the out-of-bounds read documented in [CWE-125].

Attack Vector

An attacker crafts a DHCP message with malformed option lengths and broadcasts it to the target subnet. The Windows DHCP Server accepts the message, performs the flawed length calculation, and returns response data or logs containing leaked memory. Because DHCP relies on broadcast and does not authenticate clients, any host on the adjacent network can send the trigger packet.

No verified public exploit code is available for CVE-2026-62714. Technical specifics beyond the advisory are not published. See the Microsoft CVE-2026-62714 Update Guide for vendor guidance.

Detection Methods for CVE-2026-62714

Indicators of Compromise

Unusual volume of malformed DHCP DISCOVER, REQUEST, or INFORM packets on a monitored VLAN
DHCP Server service (DHCPServer) logging repeated option-parsing errors or unexpected client requests from a single MAC address
DHCP responses containing unexpected trailing bytes or oversized payloads captured on the wire

Detection Strategies

Deploy packet inspection on DHCP UDP ports 67 and 68 to identify option fields with inconsistent length declarations
Correlate Windows Event Log entries under Microsoft-Windows-DHCP-Server for anomalous request patterns tied to a single adjacent host
Baseline normal DHCP traffic volume per segment and alert on statistical deviation from a single source

Monitoring Recommendations

Forward DHCP Server operational and admin event logs to a central SIEM for correlation across sites
Monitor MAC address churn on server-connected switch ports where DHCP servers reside
Track outbound DHCP response sizes to detect abnormally large replies that may carry leaked memory

How to Mitigate CVE-2026-62714

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-62714 Update Guide to all Windows Servers hosting the DHCP Server role
Inventory all DHCP Server instances, including those on domain controllers and branch office servers, before patching
Restrict Layer 2 access to server VLANs so that only authorized hosts can broadcast DHCP traffic

Patch Information

Microsoft has released a security update addressing CVE-2026-62714. Administrators should consult the Microsoft CVE-2026-62714 Update Guide to identify the correct update package for each supported Windows Server version and deploy it through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Enable DHCP snooping on managed switches to drop DHCP traffic from untrusted ports
Segment DHCP server subnets and enforce ACLs limiting who can send broadcast DHCP messages to the server
Where feasible, disable the Windows DHCP Server role on hosts that do not require it until the patch is applied

bash

# Example: verify Windows DHCP Server patch state via PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-WindowsFeature -Name DHCP | Select-Object Name, InstallState