CVE-2026-70124: Windows 10 1607 DHCP Information Disclosure

CVE-2026-70124 Overview

CVE-2026-70124 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated attacker can send crafted DHCP traffic over the network to read memory outside of an intended buffer boundary, resulting in information disclosure. The flaw affects a broad range of Windows client and server releases that ship the DHCP Server role, including Windows Server 2012 through Windows Server 2025.

Critical Impact
A remote, unauthenticated attacker can trigger memory disclosure in the Windows DHCP Server service without user interaction, potentially exposing sensitive process memory that aids further attacks against the network.

Affected Products

Microsoft Windows 10 version 1607 (x86, x64) and Windows 10 version 1809 (x86, x64)
Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-70124 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-70124

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes DHCP client messages arriving on UDP port 67. During parsing of a malformed DHCP request, the service reads memory beyond the bounds of an allocated buffer. The out-of-bounds read [CWE-125] returns adjacent process memory to the attacker through the server's response path, enabling information disclosure without authentication or user interaction.

Because the DHCP Server role is commonly exposed on internal networks and often runs on domain controllers or dedicated infrastructure hosts, disclosed memory can include configuration data, lease metadata, or transient pointers useful for defeating address space layout randomization. The impact is limited to confidentiality; integrity and availability are not directly affected.

Root Cause

The root cause is missing or insufficient bounds validation when the DHCP Server parses attacker-controlled option fields in a DHCP message. The parser trusts a length or offset derived from the packet and reads past the end of the buffer that holds the request data.

Attack Vector

Exploitation requires network access to UDP port 67 on a host running the Windows DHCP Server role. The attacker sends a crafted DHCP message. No credentials, privileges, or user interaction are needed. The vulnerability is exploitable from any system that can reach the DHCP service, which in most environments includes the entire broadcast domain and any relayed subnets.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported at the time of publication. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-70124

Indicators of Compromise

Unexpected inbound DHCPDISCOVER or DHCPREQUEST packets from non-client hosts, external subnets, or spoofed source addresses targeting UDP port 67.
DHCP Server service crashes, restarts, or Windows Error Reporting entries referencing dhcpssvc.dll on affected hosts.
Anomalous DHCP option fields with malformed length values in packet captures at the DHCP server or upstream relay.

Detection Strategies

Deploy network intrusion detection signatures that flag DHCP option fields whose declared length exceeds the remaining packet buffer.
Correlate DHCP service telemetry with endpoint process telemetry to surface abnormal reads or memory access patterns in the Dhcp Server service.
Baseline normal DHCP client populations per subnet and alert on new or spoofed MAC or client identifiers issuing bursts of malformed requests.

Monitoring Recommendations

Enable and forward Windows DHCP Server operational and audit logs (%windir%\System32\dhcp\) to a central SIEM for retention and rule-based alerting.
Monitor Windows Event Log channels for DHCP service faults and unexpected termination of the DHCPServer service.
Capture full packet data on DHCP-facing interfaces during triage to reconstruct malformed messages and validate suspected exploitation attempts.

How to Mitigate CVE-2026-70124

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to every host running the DHCP Server role.
Inventory Windows Server 2012 through Windows Server 2025 systems and Windows 10 1607 and 1809 endpoints with the DHCP Server feature installed, and prioritize domain-adjacent infrastructure.
Restrict UDP port 67 exposure to trusted management and client subnets using host and network firewalls until patching is complete.

Patch Information

Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should install the corresponding cumulative or standalone update for each affected Windows release and reboot as required. Refer to the Microsoft Security Update Guide entry for CVE-2026-70124 for KB article numbers and download links specific to each supported build.

Workarounds

Disable the DHCP Server service on hosts where it is not required by running Stop-Service DHCPServer and setting the service startup type to Disabled.
Constrain DHCP traffic at Layer 3 boundaries using access control lists that permit UDP 67 only from authorized DHCP relay agents and client subnets.
Enforce DHCP snooping on managed switches to drop malformed or spoofed DHCP messages before they reach the server.

bash

# Temporarily stop and disable the DHCP Server service on an unaffected role host
Stop-Service -Name DHCPServer -Force
Set-Service -Name DHCPServer -StartupType Disabled

# Restrict inbound DHCP traffic to trusted relay agents only
New-NetFirewallRule -DisplayName "Restrict DHCP Server Inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 67 `
  -RemoteAddress 10.10.0.0/24 -Action Allow