CVE-2026-70065: Windows 10 1607 DHCP Server DOS Vulnerability

CVE-2026-70065 Overview

CVE-2026-70065 is a memory leak vulnerability in the Windows DHCP Server service. The flaw stems from missing release of memory after effective lifetime, classified as [CWE-401]. An unauthenticated remote attacker can send crafted DHCP traffic that causes the server to consume memory without releasing it. Sustained exploitation exhausts server resources and produces a denial-of-service condition affecting DHCP lease issuance across the network. Microsoft addressed the issue in the September 2026 security update cycle.

Critical Impact
Unauthenticated network attackers can exhaust DHCP Server memory and disrupt IP address allocation for every client on affected network segments.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Microsoft Windows 10 version 1607 (x86 and x64)
Microsoft Windows 10 version 1809 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-70065 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-70065

Vulnerability Analysis

The Windows DHCP Server service fails to free allocated memory after the associated objects reach the end of their effective lifetime. Each processed request that triggers the vulnerable path leaves residual allocations on the heap. Over time, sustained request volume drives the dhcpserver.exe working set upward until the service can no longer allocate resources needed to service legitimate leases. The vulnerability requires no authentication and no user interaction, and it operates over the network. The DHCP service becomes unresponsive, which prevents clients from obtaining or renewing IP addresses on affected subnets.

Root Cause

The defect is a missing release of memory after effective lifetime [CWE-401]. Code paths in the DHCP Server allocate structures for incoming protocol messages but fail to deallocate them under specific conditions. Repeated triggering of the leaking path amplifies memory consumption without freeing prior allocations, leading to resource exhaustion.

Attack Vector

An unauthenticated attacker with network reach to UDP port 67 on a Windows DHCP Server sends repeated crafted DHCP messages. Each message forces the server to allocate memory that is never released. Because DHCP typically operates within broadcast domains, adjacent attackers or attackers with routed access to relay agents can reach the service. The impact is limited to availability, with no confidentiality or integrity effect. Microsoft has not published exploitation details, and no public proof-of-concept has been observed. Refer to the Microsoft CVE-2026-70065 Advisory for vendor guidance.

Detection Methods for CVE-2026-70065

Indicators of Compromise

Sustained growth of the dhcpserver.exe process working set and private bytes without a corresponding rise in active leases.
DHCP Server event log entries indicating service errors, thread pool exhaustion, or failed lease grants.
Clients on affected subnets failing to obtain or renew addresses, with APIPA (169.254.0.0/16) addresses appearing on endpoints.

Detection Strategies

Baseline DHCP Server memory and thread counts, and alert on deviations beyond normal daily patterns.
Correlate abnormally high DHCPDISCOVER or DHCPREQUEST rates from single sources against lease allocation counts.
Monitor Windows Event Log channels Microsoft-Windows-DHCP-Server/Operational and System for service crashes or restarts.

Monitoring Recommendations

Enable performance counters for DHCP Server (Packets Received/sec, Duplicates Dropped/sec, Milliseconds per packet (Avg)) and alert on sustained anomalies.
Ingest DHCP Server telemetry and Windows event logs into a centralized analytics platform for cross-host correlation.
Track lease pool exhaustion metrics and set alerts before scopes reach saturation.

How to Mitigate CVE-2026-70065

Immediate Actions Required

Apply the September 2026 Microsoft security update for all affected Windows Server and Windows 10 versions listed in the advisory.
Prioritize patching on production DHCP Server roles, particularly domain-integrated servers and those serving large scopes.
Restart the DHCP Server service after patching and verify lease issuance functions correctly.

Patch Information

Microsoft released fixes through the Microsoft Update Guide. Administrators should consult the Microsoft CVE-2026-70065 Advisory for the specific KB articles that apply to each affected build. Update packages are distributed through Windows Update, WSUS, and the Microsoft Update Catalog.

Workarounds

Restrict inbound UDP port 67 on DHCP Servers to authorized DHCP relay agents and trusted subnets via host firewall rules.
Deploy DHCP snooping on managed switches to filter unauthorized DHCP traffic at the access layer.
Configure DHCP Server failover or split-scope deployments so a single service failure does not eliminate lease availability.
Schedule periodic service restarts as a temporary containment measure until the patch is applied.

bash

# Restrict inbound DHCP traffic to trusted relay agents on Windows Server
New-NetFirewallRule -DisplayName "DHCP Server - Allow Trusted Relays" `
  -Direction Inbound -Protocol UDP -LocalPort 67 `
  -RemoteAddress 10.0.0.0/24,10.0.1.0/24 -Action Allow

New-NetFirewallRule -DisplayName "DHCP Server - Block Untrusted" `
  -Direction Inbound -Protocol UDP -LocalPort 67 -Action Block

# Verify installed updates address CVE-2026-70065
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10