CVE-2026-69930: Windows 10 1607 DHCP Information Disclosure

CVE-2026-69930 Overview

CVE-2026-69930 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server component. An unauthenticated attacker can send crafted DHCP traffic across the network to read memory outside allocated buffer boundaries. Successful exploitation allows disclosure of sensitive process memory from the DHCP Server service. The flaw affects a broad range of Windows Server releases and legacy Windows 10 builds that expose the DHCP Server role. No authentication, user interaction, or elevated privileges are required to trigger the condition.

Critical Impact
Remote unauthenticated attackers can disclose sensitive information from Windows DHCP Server process memory over the network without user interaction.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 with the DHCP Server role
Microsoft Windows 10 version 1607 (x86 and x64)
Microsoft Windows 10 version 1809 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-69930 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-69930

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes DHCP messages from clients on the local network and, when relay agents are configured, across routed networks. An out-of-bounds read occurs when the service parses a malformed DHCP message and reads beyond the intended buffer boundary. The disclosed data can include stack or heap contents adjacent to the parsed structure. Attackers can use leaked memory to bypass address space layout randomization (ASLR) or to harvest credentials, session identifiers, or other secrets present in the service address space. Because DHCP is a foundational network service, exploitation does not require prior access to the target. The condition is triggered by network-reachable input alone.

Root Cause

The root cause is missing or incorrect bounds validation when the DHCP Server parses variable-length fields in a client message. Improper length checks allow the parser to dereference memory past the allocated request buffer. This class of defect maps to [CWE-125: Out-of-bounds Read].

Attack Vector

Exploitation occurs over the network by sending crafted DHCP packets to UDP port 67 on a host running the Windows DHCP Server service. The attacker requires network reachability to the DHCP Server but does not need credentials or user interaction. Segmented networks that expose the DHCP Server only to trusted VLANs reduce the exposure surface. See the Microsoft CVE-2026-69930 Update advisory for the full technical write-up.

No public proof-of-concept exploit is available at the time of publication. The vulnerability mechanism is documented in the vendor advisory without exploitation code.

Detection Methods for CVE-2026-69930

Indicators of Compromise

Malformed DHCPDISCOVER or DHCPREQUEST packets containing option fields with length values that exceed the declared payload size.
Repeated DHCP requests from a single source address targeting UDP port 67 without corresponding lease acquisition.
Unexpected crashes, restarts, or memory anomalies in the DHCPServer service (svchost.exe hosting dhcpssvc.dll).

Detection Strategies

Inspect DHCP packet captures for option length fields that do not match actual option payload length.
Correlate DHCP service crashes in the Windows Event Log (Application and System channels) with inbound DHCP traffic bursts.
Alert on inbound DHCP traffic originating from outside the expected client subnets or relay agents.

Monitoring Recommendations

Enable DHCP audit logging on all Windows DHCP servers and forward logs to a central analytics platform.
Monitor UDP port 67 traffic volume and source diversity for anomalies against a baseline.
Track process memory and handle counts for the DHCP Server service to identify parsing anomalies.

How to Mitigate CVE-2026-69930

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-69930 Update advisory to all affected Windows Server and Windows 10 hosts.
Inventory all systems running the DHCP Server role and prioritize patching for internet-adjacent or multi-tenant environments.
Restrict inbound UDP port 67 traffic to trusted client subnets and authorized DHCP relay agents.

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-69930 for Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10 versions 1607 and 1809. Deploy the updates through Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog. Consult the vendor advisory for KB article numbers mapped to each supported build.

Workarounds

Disable the DHCP Server role on hosts where it is not required and rely on hardened DHCP appliances instead.
Enforce network segmentation so that only authorized subnets and relay agents can reach UDP port 67 on DHCP servers.
Deploy host-based firewall rules to block DHCP traffic from untrusted VLANs until patches are applied.

bash

# Block inbound DHCP server traffic from untrusted sources using Windows Firewall
New-NetFirewallRule -DisplayName "Restrict DHCP Server Inbound" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 67 `
  -RemoteAddress 10.0.0.0/8 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block DHCP Server Untrusted" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 67 `
  -Action Block