CVE-2026-62814: Windows DHCP Server Disclosure Flaw

CVE-2026-62814 Overview

CVE-2026-62814 is an integer underflow vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server. The flaw allows an unauthenticated attacker on an adjacent network to disclose sensitive information from the server. Microsoft published the advisory on August 11, 2026. The vulnerability is tracked under CWE-125: Out-of-Bounds Read, which is triggered by the underlying integer wraparound condition.

Critical Impact
A network-adjacent attacker can trigger out-of-bounds memory reads in the DHCP Server process without authentication or user interaction, exposing memory contents that may include configuration data or other sensitive artifacts.

Affected Products

Windows DHCP Server (as identified in the Microsoft advisory)
Windows Server installations providing DHCP services
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-08-11 - CVE-2026-62814 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-62814

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes DHCP messages such as DISCOVER, REQUEST, and INFORM on UDP port 67. An integer underflow occurs when the service performs arithmetic on a length or offset field derived from attacker-controlled input. When the calculation wraps below zero, the resulting value is interpreted as a large unsigned integer.

The unsigned result is then used to bound a subsequent memory read. This causes the service to read past the intended buffer, producing an out-of-bounds read condition ([CWE-125]). The read data can be returned to the attacker inside a crafted DHCP response, leaking process memory contents.

The attack is limited to information disclosure. Integrity and availability impacts are not indicated by the advisory. The scope is unchanged, meaning the impact is contained within the DHCP Server process context.

Root Cause

The root cause is unsafe arithmetic on a length or size field parsed from a DHCP packet. The service subtracts a header or option length from a smaller total-length value without validating the operands. The resulting negative value underflows to a large positive integer when stored in an unsigned type, defeating downstream bounds checks.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reside on the same broadcast domain or layer-2 segment as the target DHCP Server. This is consistent with normal DHCP traffic, which is not routed across subnets by default. No credentials and no user interaction are required. The attacker sends a malformed DHCP message with crafted length or option fields to trigger the underflow, then observes the server response for leaked memory contents.

No public proof-of-concept exploit is available at the time of publication. The EPSS score is 0.549%, indicating a low probability of exploitation in the near term.

Detection Methods for CVE-2026-62814

Indicators of Compromise

Malformed DHCP packets on UDP port 67 containing inconsistent length fields or truncated option payloads
Unexpected DHCP response traffic sent to hosts that did not initiate a DHCP transaction
Repeated DHCP DISCOVER or INFORM messages from a single source MAC address within a short window
DHCP Server service (dhcpserver.exe) exhibiting abnormal memory access patterns or crashes

Detection Strategies

Deploy DHCP packet inspection at network sensors to flag messages where declared option lengths exceed total packet size
Correlate Windows Event Log entries from the DHCP Server audit log with network capture data for anomaly identification
Monitor for outbound DHCP OFFER or ACK messages containing atypical payload sizes
Alert on any host sending DHCP client messages that violate RFC 2131 option formatting

Monitoring Recommendations

Enable DHCP audit logging on all Windows DHCP Servers and forward logs to a centralized SIEM
Baseline normal DHCP traffic volume per VLAN and alert on deviations
Track process telemetry for dhcpserver.exe, including memory usage and access violations
Restrict management-plane visibility of DHCP scopes to authorized administrators only

How to Mitigate CVE-2026-62814

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62814 to all Windows DHCP Servers
Inventory all Windows Server hosts running the DHCP Server role and prioritize patching by exposure
Segment DHCP Server hosts onto dedicated management VLANs where feasible
Verify DHCP audit logging is enabled and forwarded to a centralized log platform

Patch Information

Microsoft has published the fix through the Security Update Guide. Administrators should consult the Microsoft advisory for the specific KB numbers and cumulative updates that address CVE-2026-62814 on each affected Windows Server build. Install updates through Windows Update, WSUS, or the Microsoft Update Catalog.

Workarounds

Enforce DHCP snooping on managed switches to drop malformed client messages before they reach the server
Deploy port security and MAC address filtering on access switches to limit which hosts can send DHCP traffic
Isolate DHCP Server hosts from untrusted network segments using layer-2 access control lists
Consider temporarily relocating DHCP services to hardened relay-based architectures until patches are applied

bash

# Verify DHCP Server role and installed updates on Windows Server
Get-WindowsFeature -Name DHCP
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Enable DHCP audit logging
Set-DhcpServerAuditLog -Enable $true -Path "C:\Windows\System32\dhcp"