CVE-2026-62718 Overview
CVE-2026-62718 is an integer underflow vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. An unauthenticated attacker on an adjacent network can trigger the flaw to disclose sensitive information from the server process memory. The vulnerability is tracked under [CWE-125] and stems from a wrap-around condition during DHCP message processing.
Exploitation requires no user interaction and no privileges. Because DHCP servers process broadcast traffic from any client on the same broadcast domain, attackers with a foothold on the local network segment can reach the vulnerable service. Microsoft published the advisory on August 11, 2026.
Critical Impact
Adjacent-network attackers can read memory contents from Windows DHCP Server, potentially exposing network configuration data, credentials, or other sensitive information handled by the service.
Affected Products
- Windows DHCP Server (see Microsoft Security Update Guide for the full list of affected Windows Server builds)
- Microsoft has not published a full CPE list in the NVD entry at time of publication
Discovery Timeline
- 2026-08-11 - CVE-2026-62718 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-62718
Vulnerability Analysis
The flaw resides in Windows DHCP Server's parsing of client-supplied DHCP message fields. An arithmetic operation on a length or offset value underflows below zero and wraps to a large unsigned integer. The service then uses this oversized value in a subsequent memory read, returning out-of-bounds process memory to the requesting client.
Because the primary consequence is disclosure of memory contents, integrity and availability remain intact. The confidentiality impact is high: leaked memory may include DHCP lease data, authentication material used by DHCP integrations, or fragments from other server operations.
DHCP typically operates over UDP ports 67 and 68. An attacker on the same layer-2 segment can issue crafted DHCP requests directly to the server or via broadcast, without prior authentication.
Root Cause
The root cause is an integer underflow that produces an invalid buffer boundary, followed by an out-of-bounds read [CWE-125]. The DHCP option or field parser fails to validate that computed length values remain non-negative before they are used as size arguments in a memory copy or read.
Attack Vector
The attack vector is adjacent network. The attacker must be able to send DHCP traffic reachable by the target server, which normally means the same broadcast domain or a segment reachable through a DHCP relay. The attacker crafts a DHCP message with option fields designed to trigger the underflow, then parses the server's response for leaked memory bytes.
Refer to the Microsoft Security Update Guide entry for CVE-2026-62718 for authoritative technical details. No public proof-of-concept exploit is available at this time.
Detection Methods for CVE-2026-62718
Indicators of Compromise
- Malformed DHCP packets with abnormal option lengths or truncated field boundaries arriving at the DHCP Server
- Unexpected repeat DHCPDISCOVER or DHCPREQUEST traffic from a single MAC address targeting the same server
- DHCP Server service (DHCPServer) events indicating parsing errors or unusual response sizes
Detection Strategies
- Inspect DHCP traffic at the network layer for option fields that declare lengths inconsistent with the actual payload size
- Correlate DHCP Server Windows event logs (Event IDs in the Microsoft-Windows-DHCP-Server channel) with source MAC or relay agent identifiers
- Baseline normal DHCP client behavior per VLAN and alert on outliers issuing high volumes of crafted requests
Monitoring Recommendations
- Forward DHCP Server audit and admin logs to a centralized analytics platform for retention and hunting
- Enable packet capture on DHCP Server interfaces during triage to preserve the raw bytes of suspicious requests
- Monitor for unusual outbound traffic patterns from the DHCP Server host that could indicate exfiltration of harvested memory contents
How to Mitigate CVE-2026-62718
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62718 to all Windows Servers running the DHCP Server role
- Inventory every host with the DHCP Server role, including secondary or failover DHCP servers, and prioritize those exposed to untrusted VLANs
- Restrict access to DHCP Server management interfaces to a dedicated administrative network segment
Patch Information
Microsoft has issued a security update for the DHCP Server component. Consult the Microsoft Security Update Guide entry for CVE-2026-62718 to identify the specific KB article and cumulative update that applies to each Windows Server version in your environment. Reboot after installation to load the patched service binaries.
Workarounds
- Segment DHCP Server hosts onto dedicated VLANs and constrain relay agent sources using ACLs where feasible
- Enforce DHCP snooping on managed switches to reject rogue or malformed DHCP traffic before it reaches the server
- Where the DHCP Server role is not required, remove it using Uninstall-WindowsFeature DHCP to reduce attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
