CVE-2026-72979: Windows DHCP Server Use After Free Vulnerability

CVE-2026-72979 Overview

CVE-2026-72979 is a use-after-free vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated attacker can exploit the flaw over the network to achieve remote code execution on affected DHCP server hosts. The issue is tracked under CWE-416: Use After Free and is published in Microsoft's Security Update Guide.

DHCP servers commonly run on domain controllers and network infrastructure hosts. Successful exploitation grants control over a service that provisions network configuration to enterprise clients, enabling lateral movement and network-wide disruption.

Critical Impact
An unauthenticated network attacker can execute arbitrary code on a Windows DHCP Server, potentially compromising core network infrastructure.

Affected Products

Windows DHCP Server (Windows Server role)

Refer to the Microsoft Security Update Guide for the authoritative list of affected Windows Server builds.

Discovery Timeline

2026-09-08 - CVE-2026-72979 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72979

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which processes DHCPv4 and DHCPv6 messages on UDP ports 67 and 547. A use-after-free condition [CWE-416] occurs when the service references heap memory that has already been released during message handling.

An attacker crafts a sequence of DHCP protocol messages that trigger the free of an internal object while another code path retains a dangling pointer. Subsequent access dereferences the freed memory, producing a controllable state that leads to remote code execution in the context of the DHCP service.

Because DHCP servers typically run with elevated privileges and are often co-located with Active Directory infrastructure, code execution here has direct consequences for network-wide trust boundaries.

Root Cause

The root cause is improper lifetime management of a heap-allocated object within the DHCP server message-processing path. The object is freed while a stale reference remains reachable, violating the invariant that a freed allocation is no longer accessed.

Attack Vector

Exploitation is performed remotely over the network without authentication and without user interaction. An attacker with layer-3 reachability to the DHCP service can send crafted DHCP traffic to trigger the flaw. Networks that expose DHCP services beyond trust boundaries or across insufficiently segmented VLANs face higher exposure.

No public proof-of-concept has been observed at the time of publication. Refer to the Microsoft Security Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-72979

Indicators of Compromise

Unexpected crashes or restarts of the DHCPServer service on Windows Server hosts.
Anomalous DHCP traffic patterns, including malformed DISCOVER, REQUEST, or RELAY-FORWARD messages from unusual source addresses.
New or unexpected child processes spawned by svchost.exe hosting the DHCP service.

Detection Strategies

Monitor Windows Event Log sources Microsoft-Windows-DHCP-Server and Application for service failures, access violations, and abnormal termination events.
Correlate network telemetry for DHCP traffic on UDP/67 and UDP/547 against baseline volumes and expected client subnets.
Alert on process-creation events where the DHCP service host process spawns command interpreters or network utilities such as cmd.exe, powershell.exe, or rundll32.exe.

Monitoring Recommendations

Enable audit logging for the DHCP Server role and forward events to a centralized SIEM for retention and correlation.
Baseline outbound connections from DHCP servers; any egress to external hosts warrants investigation.
Track patch state across Windows Server DHCP hosts using authoritative configuration management data.

How to Mitigate CVE-2026-72979

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows Server hosts running the DHCP Server role.
Inventory every host with the DHCP Server role enabled, including non-production and disaster recovery systems.
Restrict DHCP service exposure to trusted VLANs and management subnets using host and network firewalls.

Patch Information

Microsoft has published guidance and updates in the Microsoft Security Update Guide entry for CVE-2026-72979. Administrators should consult the advisory for build-specific KB numbers and superseded update information.

Workarounds

Where patching is not immediately feasible, block UDP/67 and UDP/547 at network boundaries facing untrusted segments.
Enforce DHCP relay configurations that limit which subnets can send messages to the DHCP server.
Consider temporarily disabling the DHCP Server service on non-essential hosts until updates are applied.

bash

# Verify DHCP service state and installed updates on Windows Server
Get-Service DHCPServer
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Restrict DHCP inbound traffic to authorized relay agents only
New-NetFirewallRule -DisplayName "Restrict DHCPv4" -Direction Inbound -Protocol UDP -LocalPort 67 -RemoteAddress <trusted_relay_subnet> -Action Allow
New-NetFirewallRule -DisplayName "Block DHCPv4 Other" -Direction Inbound -Protocol UDP -LocalPort 67 -Action Block