CVE-2026-62742: Windows DHCP Server Disclosure Flaw

CVE-2026-62742 Overview

CVE-2026-62742 is an integer underflow vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server. An unauthenticated attacker on an adjacent network can trigger the flaw to disclose sensitive information from the server process. The weakness is classified under CWE-125 (Out-of-bounds Read), which results from the integer wraparound during message parsing. Microsoft published the advisory on August 11, 2026.

Critical Impact
A successful attack exposes memory contents from the Windows DHCP Server service without requiring authentication or user interaction, provided the attacker has access to the same broadcast domain.

Affected Products

Windows DHCP Server (see the Microsoft CVE-2026-62742 Advisory for the authoritative list of affected Windows Server builds)

Discovery Timeline

2026-08-11 - CVE-2026-62742 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62742

Vulnerability Analysis

The DHCP Server service parses client DHCP messages that contain length-prefixed option fields. During processing, an arithmetic operation on an untrusted length value underflows, producing a very large unsigned integer. The service then treats this wrapped value as the size of a buffer window to read, causing an out-of-bounds read past the intended message boundary.

Because the read occurs in the address space of the DHCP Server process, leaked bytes can include lease state, cached credentials material, or other server memory adjacent to the parsing buffer. The attack targets confidentiality only; integrity and availability of the server are not directly affected by this bug. The EPSS score at publication was approximately 0.49%.

Root Cause

The root cause is unchecked subtraction on a size field derived from attacker-controlled DHCP option data. When the supplied length is smaller than a fixed header offset, the subtraction wraps below zero and yields a large positive value in the unsigned integer used for the subsequent read loop. The absence of a signed comparison before the arithmetic allows the malformed packet to bypass bounds enforcement.

Attack Vector

Exploitation requires the attacker to reach a Windows DHCP Server on an adjacent network segment, such as the same VLAN or broadcast domain used for DHCP discovery. The attacker crafts a DHCP request or inform packet containing a malformed option length that triggers the underflow. Response traffic or logged output can then leak the out-of-bounds bytes back to the attacker. Since DHCP relies on broadcast, no prior credentials or user interaction are required.

No public proof-of-concept exploit is available at this time. See the Microsoft CVE-2026-62742 Advisory for further technical detail.

Detection Methods for CVE-2026-62742

Indicators of Compromise

Unusually large or malformed DHCP option fields in packet captures on UDP ports 67 and 68.
Repeated DHCP DISCOVER, REQUEST, or INFORM messages from a single client MAC within a short window.
Windows Event Log entries from the DhcpServer source showing parsing errors or unexpected client input.

Detection Strategies

Deploy network intrusion detection signatures that flag DHCP options with length fields shorter than their declared header size.
Correlate DHCP server telemetry with switch port and MAC address data to isolate the source of anomalous requests.
Monitor process memory usage of the Dhcp service for abnormal spikes that may indicate exploitation attempts.

Monitoring Recommendations

Forward Windows DHCP Server audit logs and Sysmon network telemetry to a centralized analytics platform for review.
Enable full packet capture on DHCP-serving subnets during triage to preserve evidence of malformed options.
Alert on any DHCP traffic sourced from unexpected VLANs or from hosts that are not authorized DHCP clients.

How to Mitigate CVE-2026-62742

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-62742 Advisory to all Windows Server systems running the DHCP Server role.
Inventory every DHCP Server instance, including those on domain controllers and branch office servers, to confirm patch coverage.
Restrict layer 2 access to DHCP-serving segments so that only trusted devices can broadcast on the same network.

Patch Information

Microsoft has released an update addressing CVE-2026-62742 through the standard security update channel. Administrators should consult the Microsoft CVE-2026-62742 Advisory for the specific KB article and build numbers for each supported version of Windows Server.

Workarounds

Enable DHCP snooping on managed switches to block rogue or malformed DHCP traffic from untrusted ports.
Segment DHCP servers behind port-level ACLs that restrict inbound traffic on UDP 67 to known relay agents.
Where feasible, migrate critical subnets to authenticated address assignment mechanisms until patching is complete.

bash

# Example: block DHCP from untrusted access ports using DHCP snooping (Cisco IOS syntax)
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
interface range GigabitEthernet1/0/1 - 24
 no ip dhcp snooping trust
interface GigabitEthernet1/0/48
 ip dhcp snooping trust