CVE-2026-77502: Windows DHCP Server DOS Vulnerability

CVE-2026-77502 Overview

CVE-2026-77502 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated remote attacker can send crafted DHCP messages that force the server to read memory outside allocated bounds. Successful exploitation causes the DHCP Server service to crash, denying address leasing and renewal to network clients.

The vulnerability requires no privileges and no user interaction. Because DHCP is a foundational network service, an outage can cascade to workstations, servers, and IoT devices that depend on dynamic address assignment for connectivity.

Critical Impact
Unauthenticated attackers on the network can crash the Windows DHCP Server service, disrupting IP address allocation across affected network segments.

Affected Products

Microsoft Windows Server with the DHCP Server role enabled
See the Microsoft Security Update Guide for the complete list of affected Windows Server versions
Environments relying on Windows DHCP for client address assignment

Discovery Timeline

2026-09-08 - CVE-2026-77502 published to the National Vulnerability Database
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-77502

Vulnerability Analysis

The vulnerability resides in how the Windows DHCP Server service parses incoming DHCP protocol messages. An out-of-bounds read [CWE-125] occurs when the service reads memory beyond the intended buffer boundary while processing attacker-supplied fields. The invalid read triggers an access violation that terminates the service process.

Because the DHCP protocol runs over UDP ports 67 and 68, an attacker only needs the ability to send packets to the server. No authentication, credentials, or user interaction are required. The impact is limited to availability; confidentiality and integrity are not affected according to the CVSS vector.

Repeated exploitation can keep the service in a crash-restart loop, preventing clients from acquiring or renewing IP leases. Network segments dependent on the affected server lose connectivity as existing leases expire.

Root Cause

The root cause is missing or insufficient bounds validation when the DHCP Server parses fields in a DHCP message. Malformed length or option fields cause the parser to reference memory beyond the allocated buffer, producing the out-of-bounds read condition described in [CWE-125].

Attack Vector

The attack vector is network-based. An attacker sends crafted DHCP packets to UDP port 67 on the target server. Refer to the Microsoft Security Update Guide for detailed technical guidance and patch availability.

No public proof-of-concept exploit has been observed at the time of publication. The Exploit Prediction Scoring System (EPSS) currently ranks this issue in the mid range of exploitation likelihood.

Detection Methods for CVE-2026-77502

Indicators of Compromise

Unexpected termination or restart of the DHCPServer service on Windows Server systems
Windows Event Log entries showing service crashes, access violations, or Dr. Watson reports tied to dhcpssvc.dll
Sudden drop in DHCPACK responses or spike in client DHCPDISCOVER retries on affected subnets
Inbound DHCP traffic from unexpected sources or with anomalous option lengths

Detection Strategies

Monitor Windows Event Log IDs associated with DHCP service start, stop, and failure events (System log, source DHCPServer)
Alert on repeated Service Control Manager events reporting the DHCP Server service entering an unexpected stopped state
Inspect network telemetry for malformed DHCP packets or high-rate DHCP traffic from a single source

Monitoring Recommendations

Enable DHCP audit logging and forward logs to a centralized SIEM for correlation
Track DHCP scope utilization and lease-issuance rates to detect service degradation early
Baseline normal DHCP client volume per subnet and alert on statistically significant drops

How to Mitigate CVE-2026-77502

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows Server systems running the DHCP Server role
Prioritize patching servers exposed to untrusted or partially trusted network segments
Verify DHCP failover or backup scopes are healthy so a service disruption does not exhaust available leases

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Response Center (MSRC). Administrators should consult the Microsoft Security Update Guide for the specific KB article, affected build numbers, and installation instructions applicable to their Windows Server version.

Workarounds

Restrict inbound UDP traffic on ports 67 and 68 to trusted VLANs and management networks using host and network firewalls
Enable DHCP snooping on managed switches to drop rogue or malformed DHCP traffic before it reaches the server
Configure DHCP failover between two Windows DHCP servers so a crash on one node does not interrupt lease issuance
Segment client networks so a single DHCP outage does not affect the entire environment