CVE-2026-62716: Windows DHCP Server Info Disclosure Flaw

CVE-2026-62716 Overview

CVE-2026-62716 is an integer underflow vulnerability in the Windows DHCP Server service. The flaw allows an unauthenticated attacker on an adjacent network to disclose sensitive information from the server. The vulnerability is tracked under CWE-125 (Out-of-bounds Read) and stems from an integer wraparound during DHCP message handling.

Critical Impact
An adjacent-network attacker can trigger an out-of-bounds read in the Windows DHCP Server, exposing memory contents without authentication or user interaction.

Affected Products

Windows DHCP Server (Windows Server editions as listed in the Microsoft Security Update CVE-2026-62716)

Discovery Timeline

2026-08-11 - CVE-2026-62716 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62716

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes Dynamic Host Configuration Protocol messages from clients on the local network segment. An integer underflow in the message parsing logic causes a length or offset calculation to wrap around to a large unsigned value. The DHCP Server subsequently performs a read operation using this corrupted value, resulting in an out-of-bounds read as classified under [CWE-125].

The attacker must reside on the same broadcast domain or adjacent network as the vulnerable DHCP Server. No credentials or user interaction are required to trigger the flaw. Successful exploitation discloses process memory contents, which may contain lease data, authentication material, or other sensitive information handled by the DHCP service.

The EPSS probability is 0.478 percent, indicating limited observed exploitation likelihood at time of publication.

Root Cause

The root cause is arithmetic on an unsigned integer field derived from attacker-controlled DHCP packet data. When a length field is smaller than an expected header offset, the subtraction underflows and produces a very large size value. The service then reads past the intended buffer boundary using this value, leaking adjacent memory back to the requester.

Attack Vector

Exploitation requires network adjacency, typically meaning the attacker sits on the same VLAN or physical segment as the target DHCP Server. The attacker crafts a malformed DHCP message with manipulated length fields and sends it as a broadcast or unicast request. The DHCP Server parses the message, triggers the underflow, and returns a response containing leaked memory bytes.

Refer to the Microsoft Security Update CVE-2026-62716 advisory for vendor technical details. No public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-62716

Indicators of Compromise

Unusual volumes of malformed DHCP DISCOVER, REQUEST, or INFORM packets originating from a single host on a local subnet.
DHCP Server event log entries indicating parsing errors, dropped packets, or service anomalies around the time of suspicious traffic.
Unexpected DHCP responses containing atypical option payloads or padding patterns.

Detection Strategies

Deploy network monitoring rules that flag DHCP packets with inconsistent length fields relative to declared option sizes.
Correlate DHCP Server process crashes or restarts on Windows Server hosts with concurrent DHCP traffic anomalies.
Baseline normal DHCP client behavior per subnet and alert on hosts issuing malformed or repeated requests outside expected patterns.

Monitoring Recommendations

Ingest Windows DHCP Server audit logs (DhcpSrvLog-*.log) and the Microsoft-Windows-DHCP-Server event channel into a central SIEM for continuous review.
Monitor UDP port 67 traffic for volumetric anomalies and packets exceeding expected structural bounds.
Enable network segmentation telemetry to identify lateral positioning within broadcast domains that host DHCP infrastructure.

How to Mitigate CVE-2026-62716

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62716 advisory to all Windows DHCP Server hosts.
Inventory all Windows Server systems running the DHCP Server role and prioritize patching for those exposed to untrusted network segments.
Restrict access to DHCP server subnets using network access control (NAC), 802.1X, or port security to limit adjacent attack surface.

Patch Information

Microsoft has published a security update for CVE-2026-62716. Consult the Microsoft Security Update CVE-2026-62716 advisory for the list of affected Windows Server builds and corresponding KB article identifiers. Apply the update through Windows Update, WSUS, or your preferred patch management tooling and reboot as required.

Workarounds

Segment DHCP Server hosts onto isolated management VLANs and enforce strict layer-2 access controls until patches are deployed.
Where operationally feasible, disable the DHCP Server role on hosts that do not require it and rely on hardened, patched DHCP appliances.
Enable DHCP snooping and rate limiting on managed switches to reduce the volume of malformed requests reaching the server.

bash

# Verify DHCP Server role status and installed updates on Windows Server
Get-WindowsFeature -Name DHCP
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Optional: stop the DHCP Server service on hosts that do not require the role
Stop-Service -Name DHCPServer
Set-Service -Name DHCPServer -StartupType Disabled