CVE-2026-77498: Windows DHCP Server DOS Vulnerability

CVE-2026-77498 Overview

CVE-2026-77498 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated attacker can send crafted DHCP traffic across the network to trigger a memory read beyond an allocated buffer. The condition causes the DHCP Server service to crash, denying address assignment to network clients.

The vulnerability requires no privileges, no user interaction, and can be exploited over the network. It affects service availability only; confidentiality and integrity are not impacted. Microsoft published the advisory on 2026-09-08.

Critical Impact
A remote, unauthenticated attacker can crash the Windows DHCP Server service and disrupt automatic IP address assignment for every client that depends on the affected scope.

Affected Products

Microsoft Windows Server with the DHCP Server role enabled
Refer to the Microsoft Security Update CVE-2026-77498 advisory for the complete list of affected builds
Environments that rely on Windows DHCP for dynamic IP allocation

Discovery Timeline

2026-09-08 - CVE CVE-2026-77498 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77498

Vulnerability Analysis

The flaw resides in the Windows DHCP Server service, which processes DHCP client messages such as DHCPDISCOVER, DHCPREQUEST, and DHCPINFORM on UDP port 67. A parsing routine reads DHCP option fields without validating length or bounds against the received packet. When a crafted packet supplies a malformed option, the service reads outside the allocated buffer.

The out-of-bounds read triggers an access violation that terminates the DHCP Server process. Clients within the affected scopes lose the ability to obtain or renew IP leases until the service restarts. Automatic recovery mechanisms may loop if the attacker resends the malicious traffic.

Root Cause

The root cause is missing bounds validation during DHCP option parsing, classified under [CWE-125] Out-of-bounds Read. The parser trusts attacker-controlled length fields inside DHCP option TLV (type-length-value) structures. Reading beyond the allocated buffer dereferences memory that is not owned by the parsing context.

Attack Vector

Exploitation requires only network reachability to UDP port 67 on a Windows server running the DHCP role. DHCP traffic is broadcast within a subnet, so any device connected to the same broadcast domain can send the malformed packet. DHCP relay agents can extend the attack surface across routed segments.

No public proof-of-concept exploit is currently listed for this CVE. Microsoft has not reported active exploitation and it is not present on the CISA Known Exploited Vulnerabilities catalog. The Exploit Prediction Scoring System (EPSS) reflects a moderate near-term exploitation probability as of 2026-09-10.

See the Microsoft Security Update CVE-2026-77498 advisory for technical specifics.

Detection Methods for CVE-2026-77498

Indicators of Compromise

Unexpected termination or repeated crashes of the DHCPServer service on Windows Server hosts.
Windows Event Log entries showing Service Control Manager errors for DHCPServer or application faults in dhcpssvc.dll.
Spikes in malformed DHCP option payloads observed on UDP port 67 through packet captures.
Client-side failures to obtain or renew DHCP leases coinciding with server-side crashes.

Detection Strategies

Alert on DHCPServer service stop, start, or crash events using Windows Event IDs 7031, 7034, and 1000 correlated per host.
Deploy network intrusion detection signatures that flag DHCP packets with option length fields extending beyond packet boundaries.
Baseline DHCP request volume per subnet and alert on abnormal bursts from a single source MAC or IP.

Monitoring Recommendations

Forward Windows System and Application logs from all DHCP servers to a centralized SIEM for correlation.
Monitor DHCP scope availability and lease issuance rates to detect service degradation early.
Capture NetFlow or full packet data at DHCP relay points to support post-incident analysis.

How to Mitigate CVE-2026-77498

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-77498 advisory to every Windows Server running the DHCP Server role.
Inventory all DHCP servers, including secondary and failover partners, and prioritize patching those exposed to untrusted network segments.
Enable automatic restart of the DHCPServer service to reduce outage duration while patching is scheduled.

Patch Information

Microsoft released a security update addressing the out-of-bounds read in the DHCP Server parser. Consult the Microsoft Security Update CVE-2026-77498 advisory for the specific KB article, affected builds, and installation guidance. Apply the update through Windows Update, WSUS, or your enterprise patch management platform.

Workarounds

Restrict UDP port 67 traffic at network boundaries so that only trusted subnets and authorized DHCP relay agents can reach DHCP servers.
Deploy DHCP snooping on managed switches to drop malformed DHCP messages from untrusted ports.
Configure DHCP failover or split-scope pairs so that a crash on one server does not fully interrupt lease service.
Segment guest and untrusted networks onto dedicated DHCP scopes with isolated servers where feasible.

bash

# Example: enable automatic recovery for the DHCP Server service on Windows
sc.exe failure DHCPServer reset= 86400 actions= restart/5000/restart/5000/restart/5000
sc.exe failureflag DHCPServer 1