CVE-2026-62823: Windows DHCP Server Buffer Overflow Flaw

CVE-2026-62823 Overview

CVE-2026-62823 is a heap-based buffer overflow vulnerability in the Windows DHCP Server service. An unauthenticated attacker on an adjacent network can send crafted DHCP traffic to trigger memory corruption in the server process. Successful exploitation leads to arbitrary code execution in the context of the DHCP Server service, which typically runs with elevated privileges on Windows Server hosts.

The flaw is tracked under CWE-122: Heap-based Buffer Overflow and carries a CVSS 3.1 base score of 8.8. Microsoft published details in the Microsoft Security Update CVE-2026-62823 advisory.

Critical Impact
Adjacent-network attackers can execute arbitrary code on Windows DHCP Servers without authentication or user interaction, compromising confidentiality, integrity, and availability of core network infrastructure.

Affected Products

Windows DHCP Server (see Microsoft advisory for the specific Windows Server builds addressed)
Windows Server roles running the DHCP Server service
Refer to the Microsoft Security Update Guide for the authoritative product and build list

Discovery Timeline

2026-08-11 - CVE-2026-62823 published to the National Vulnerability Database
2026-08-12 - Last updated in the NVD database

Technical Details for CVE-2026-62823

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes DHCP client requests such as DHCPDISCOVER, DHCPREQUEST, and DHCPINFORM messages on UDP port 67. A parsing routine in the service fails to correctly validate the size of one or more attacker-controlled fields before copying data into a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or objects.

An attacker positioned on the same broadcast domain as the DHCP Server can send malformed DHCP packets that trigger the overflow. Because DHCP servers accept unsolicited broadcast traffic, no prior authentication or session state is required. The Exploit Prediction Scoring System (EPSS) currently rates this issue at 0.555%, and no public proof-of-concept has been observed.

Root Cause

The root cause is missing or insufficient bounds checking during DHCP option parsing. Variable-length option fields are copied into a fixed-size heap buffer without validating that the declared length matches the actual buffer capacity. This condition maps to CWE-122: Heap-based Buffer Overflow.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reach the DHCP Server through Layer 2 adjacency or a routed segment that forwards DHCP traffic through relay agents. The attacker crafts a DHCP packet containing an oversized or malformed option and broadcasts it to the server. Once the overflow triggers, controlled heap corruption can lead to code execution in the DHCP Server process context.

No verified exploit code is available. Refer to the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2026-62823

Indicators of Compromise

Unexpected crashes or restarts of the DHCPServer service, or Windows Error Reporting entries referencing dhcpssvc.dll
Anomalous DHCP packets with malformed or oversized options observed on the local segment
New or unauthorized child processes spawned by svchost.exe hosting the DHCP Server service
Outbound network connections initiated by the DHCP Server host to untrusted destinations

Detection Strategies

Monitor Windows Event Log channels Microsoft-Windows-DHCP-Server/Operational and Application for service faults and access violations
Inspect DHCP traffic at the network layer for oversized option fields or malformed message structures using IDS signatures
Baseline expected DHCP client MAC addresses and flag anomalous sources sending unusual option payloads
Correlate DHCP service crashes with process-creation telemetry from the host to identify post-exploitation activity

Monitoring Recommendations

Enable process-creation auditing (Event ID 4688) on all DHCP Server hosts and forward events to a central SIEM
Alert on child processes of svchost.exe -k DHCPServer that are not part of the expected process tree
Capture and retain DHCP traffic samples from server-facing interfaces for retrospective analysis
Track service restart frequency for the DHCP Server role as a heap-corruption indicator

How to Mitigate CVE-2026-62823

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62823 to all Windows Servers running the DHCP Server role
Inventory every host with the DHCP Server role installed and prioritize patching for internet-adjacent or high-value segments
Restrict Layer 2 access to DHCP Server subnets and audit DHCP relay configurations for unnecessary forwarding paths
Review recent Windows Event Logs on DHCP Servers for signs of service crashes or exploitation attempts

Patch Information

Microsoft has released a security update addressing this vulnerability. Consult the Microsoft Security Update Guide entry for CVE-2026-62823 for the specific KB article, affected builds, and installation guidance. Deploy the update through Windows Update, WSUS, Microsoft Intune, or Configuration Manager according to your patch management process.

Workarounds

Where patching cannot occur immediately, isolate DHCP Servers on dedicated management VLANs and restrict client-facing interfaces
Disable the DHCP Server role temporarily on non-critical hosts and rely on alternate DHCP infrastructure until patches are applied
Enforce DHCP snooping on managed switches to filter malformed or unauthorized DHCP traffic at the network edge
Limit DHCP relay agents to trusted subnets to reduce the exposure of the DHCP Server to remote adjacent networks

bash

# Check whether the DHCP Server role is installed and running (PowerShell)
Get-WindowsFeature -Name DHCP
Get-Service -Name DHCPServer

# Verify installed updates against the KB listed in the MSRC advisory
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20