CVE-2026-69803: Windows 10 1607 DHCP Information Disclosure

CVE-2026-69803 Overview

CVE-2026-69803 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated remote attacker can send crafted DHCP traffic to a vulnerable server and read memory contents outside the intended buffer boundary. Successful exploitation results in information disclosure over the network without user interaction.

The flaw affects DHCP Server components shipped with multiple Windows Server and Windows 10 releases. Microsoft published the advisory on September 8, 2026, and rates the confidentiality impact as high while integrity and availability remain unaffected.

Critical Impact
Unauthenticated network attackers can disclose memory contents from Windows DHCP Server processes, potentially exposing credentials, session data, or configuration information usable in follow-on attacks.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (DHCP Server role)
Microsoft Windows 10 version 1607 (x86 and x64)
Microsoft Windows 10 version 1809 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-69803 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-69803

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which listens on UDP port 67 for client requests. When parsing certain DHCP message fields, the server reads beyond the allocated buffer boundary. The out-of-bounds read returns adjacent process memory that can be reflected back to the requesting client.

Because the DHCP Server service runs with elevated privileges, disclosed memory may contain authentication material, cached lease data, or pointers useful for defeating address space layout randomization. Attackers can chain the information disclosure with other flaws to escalate impact.

The attack requires network reachability to UDP/67 on the target server. No authentication, user interaction, or prior foothold is needed. DHCP servers exposed to broader network segments face the highest exposure.

Root Cause

The underlying defect is an out-of-bounds read [CWE-125] triggered during DHCP option or packet field parsing. The parser fails to validate a length or offset value against the actual buffer size before dereferencing memory, allowing adjacent bytes to be read and returned in a response.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a specially crafted DHCP request or renewal message to a vulnerable Windows DHCP Server. The server processes the malformed input, reads out-of-bounds memory, and includes portions of that memory in its response. Repeated queries allow the attacker to reconstruct sensitive server-side data.

No verified public exploit or proof-of-concept is available at the time of publication. Refer to the Microsoft Security Update Guide for CVE-2026-69803 for authoritative technical details.

Detection Methods for CVE-2026-69803

Indicators of Compromise

Unusual volumes of DHCPDISCOVER, DHCPREQUEST, or DHCPINFORM traffic to UDP/67 from single or spoofed sources
Malformed DHCP option fields with oversized or inconsistent length values captured in packet inspection
Unexpected outbound DHCP responses containing unusually large payloads or non-standard field content
DHCP Server service log anomalies referencing parsing errors or unexpected client message formats

Detection Strategies

Deploy network intrusion detection signatures that flag DHCP messages with option length fields exceeding the packet boundary
Correlate DHCP request volume against normal client baselines to identify probing behavior
Enable and monitor the Microsoft-Windows-DHCP-Server operational and audit event logs for parser exceptions
Compare outbound DHCP response sizes across the fleet; anomalous responses may indicate leaked memory

Monitoring Recommendations

Forward DHCP Server event logs and packet metadata to a centralized SIEM for correlation and retention
Alert on DHCP requests originating from unauthorized VLANs or unmanaged network segments
Track Windows Update compliance for the DHCP Server role across all Windows Server hosts
Continuously enumerate systems running the DHCP Server role and confirm they receive the September 2026 security update

How to Mitigate CVE-2026-69803

Immediate Actions Required

Apply the September 2026 Microsoft security update addressing CVE-2026-69803 to all Windows Server systems running the DHCP Server role
Inventory every host with the DHCP Server feature installed, including domain-joined and workgroup servers
Restrict UDP/67 exposure so only trusted client subnets can reach DHCP servers
Prioritize patching for DHCP servers reachable from user, guest, or partner network segments

Patch Information

Microsoft has released security updates for all affected Windows versions. Consult the Microsoft Security Update Guide for CVE-2026-69803 for the specific KB articles corresponding to Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10 versions 1607 and 1809. Install the update through Windows Update, WSUS, or your preferred patch management platform and reboot the server to activate the fix.

Workarounds

If patching cannot be performed immediately, restrict DHCP traffic to authorized client VLANs using switch ACLs or DHCP snooping
Isolate DHCP servers behind host-based firewalls that only permit UDP/67 from known client ranges
Where feasible, temporarily failover to an unaffected DHCP provider until patches are applied
Monitor DHCP Server telemetry continuously until the patched build is deployed across the environment

bash

# Example: restrict inbound DHCP to a specific client subnet on a Windows host firewall
New-NetFirewallRule -DisplayName "DHCP Server - Restrict Clients" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 67 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

# Block all other inbound DHCP requests
New-NetFirewallRule -DisplayName "DHCP Server - Block Untrusted" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 67 `
  -Action Block