CVE-2026-77501: Windows DHCP Server DOS Vulnerability

CVE-2026-77501 Overview

CVE-2026-77501 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Windows Dynamic Host Configuration Protocol (DHCP) Server. An unauthenticated attacker can send crafted network traffic to the DHCP service and trigger a denial-of-service condition. The flaw does not require user interaction or prior privileges, and it is exploitable directly over the network.

Successful exploitation halts DHCP address assignment across affected network segments. Clients that rely on the service for IP configuration lose network connectivity when leases expire or when new devices attempt to join.

Critical Impact
Remote, unauthenticated attackers can disrupt Windows DHCP Server availability without user interaction, breaking IP address allocation for downstream clients.

Affected Products

Microsoft Windows DHCP Server (specific supported Windows Server versions listed in the Microsoft advisory)

Discovery Timeline

2026-09-08 - CVE-2026-77501 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-77501

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Windows DHCP Server service. The service reads memory beyond the boundary of an intended buffer while processing attacker-supplied network input. The read triggers an access violation that terminates the DHCP service process.

The flaw affects availability only. It does not disclose memory contents to the attacker and does not allow code execution or tampering with data on the host. The impact is confined to service uptime and, by extension, DHCP-dependent client connectivity.

The attack requires no authentication and no user interaction. An attacker with network reach to UDP port 67 on an affected server can send a malformed DHCP message to invoke the vulnerable code path.

Root Cause

The root cause is missing or insufficient bounds checking when the DHCP Server parses incoming protocol fields. When a field length or offset value in the DHCP message references data outside the allocated buffer, the parser dereferences memory it does not own. Refer to the Microsoft CVE-2026-77501 Update Guide for vendor detail.

Attack Vector

Exploitation is performed over the network by sending a crafted DHCP packet to an affected Windows DHCP Server. Because DHCP typically operates on local broadcast domains, the most direct threat model is an attacker positioned inside a routable segment that reaches the DHCP service. DHCP relay configurations can extend the reachable attack surface across subnets.

No authenticated code paths are involved. A single malformed packet can crash the service, and repeated packets can prevent restart-based recovery.

No public proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.835%.

Detection Methods for CVE-2026-77501

Indicators of Compromise

Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts.
Windows Event Log entries showing service crashes, access violations, or Watson error reports tied to dhcpssvc.dll.
Sudden spikes in DHCPDISCOVER or malformed DHCP packets arriving at UDP port 67 from a single source.
Client-side reports of failed IP address renewal and gateways issuing APIPA (169.254.0.0/16) addresses.

Detection Strategies

Monitor Windows Service Control Manager events (Event IDs 7031, 7034) for the DHCP Server service on affected hosts.
Inspect DHCP server operational logs for parsing errors or abrupt session termination near packet arrival timestamps.
Deploy network IDS signatures that flag DHCP messages with malformed option lengths or oversized fields on UDP/67.

Monitoring Recommendations

Alert on any crash of the DHCPServer service in centralized logging or SIEM platforms.
Baseline normal DHCP request rates per subnet and alert on statistically significant deviations.
Correlate DHCP service restarts with concurrent client lease-renewal failures to identify active abuse.

How to Mitigate CVE-2026-77501

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-77501 Update Guide to all Windows Server hosts running the DHCP Server role.
Inventory all systems with the DHCP Server role enabled and prioritize internet-adjacent and multi-tenant environments.
Enable automatic service recovery on the DHCPServer service to reduce outage duration if the process terminates.

Patch Information

Microsoft has released fixes as part of its security update process. Consult the Microsoft CVE-2026-77501 Update Guide for the specific Knowledge Base articles, affected Windows Server builds, and update packages that correspond to each supported release.

Workarounds

Restrict UDP/67 traffic to trusted DHCP relay agents and management subnets using host and network firewalls.
Segment DHCP Server hosts from untrusted VLANs and guest network segments where attackers may gain a foothold.
Deploy a redundant DHCP server on a separate host to maintain lease issuance if one server is disrupted.

bash

# Configuration example: restrict inbound DHCP to authorized relay agents on Windows Server
# Replace <RelayAgentIP> with the IP of each trusted DHCP relay
New-NetFirewallRule -DisplayName "DHCP Server - Allow Trusted Relays" `
  -Direction Inbound -Protocol UDP -LocalPort 67 `
  -RemoteAddress <RelayAgentIP> -Action Allow

New-NetFirewallRule -DisplayName "DHCP Server - Block Untrusted" `
  -Direction Inbound -Protocol UDP -LocalPort 67 -Action Block

# Enable automatic recovery of the DHCP Server service
sc.exe failure DHCPServer reset= 86400 actions= restart/5000/restart/5000/restart/5000