CVE-2026-77886: Windows DHCP Server DoS Vulnerability

CVE-2026-77886 Overview

CVE-2026-77886 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated attacker can send crafted DHCP traffic over the network to trigger the flaw and deny service to legitimate clients. Successful exploitation disrupts IP address assignment across affected network segments, breaking connectivity for endpoints that rely on DHCP for lease renewal. Microsoft published the advisory on September 8, 2026, and the vulnerability affects availability without exposing confidentiality or integrity.

Critical Impact
Remote, unauthenticated denial of service against Windows DHCP Server can disable address assignment for entire network segments and disrupt enterprise connectivity.

Affected Products

Windows DHCP Server (versions specified in the Microsoft advisory)
Windows Server deployments running the DHCP Server role
Network segments dependent on affected DHCP infrastructure

Discovery Timeline

2026-09-08 - CVE-2026-77886 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77886

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which listens on UDP port 67 for client requests. A malformed DHCP packet causes the server to read memory beyond an allocated buffer boundary. The out-of-bounds read triggers a service crash or unrecoverable state, terminating DHCP responses to clients on the network. Because DHCP is a foundational network service, its failure cascades into broader connectivity outages as leases expire and new clients cannot obtain addresses.

Attackers do not need credentials, user interaction, or prior access. A single crafted packet delivered to a reachable DHCP server is sufficient to trigger the condition. Repeated packets can maintain a persistent denial of service against the service.

Root Cause

The root cause is an out-of-bounds read [CWE-125] during parsing of DHCP message fields. The server dereferences memory outside the intended buffer when handling attacker-controlled input, producing an access violation. Microsoft's advisory identifies the flaw as an availability-impact issue with no confidentiality or integrity exposure.

Attack Vector

The attack vector is network-based. An attacker on any network path reachable by the DHCP Server sends a crafted DHCP request or related message to UDP port 67. The service processes the malformed field and reads out-of-bounds memory, terminating the process or the request handler. No authentication or user interaction is required.

Refer to the Microsoft Security Update for CVE-2026-77886 for packet-level technical details and affected build numbers.

Detection Methods for CVE-2026-77886

Indicators of Compromise

Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts
Windows Event Log entries showing access violations or crashes tied to dhcpssvc.dll
Sudden drop in DHCP lease grants across monitored subnets
Anomalous DHCP DISCOVER or REQUEST packets with malformed options fields arriving from unexpected sources

Detection Strategies

Monitor Windows Service Control Manager events for stops and restarts of the DHCP Server service
Alert on process crashes involving svchost.exe hosting the DHCP Server service
Deploy network sensors to identify malformed DHCP packets targeting UDP port 67
Correlate DHCP service failures with concurrent client connectivity loss to distinguish attacks from configuration errors

Monitoring Recommendations

Ingest Windows Event Logs and DHCP audit logs into a centralized analytics platform for continuous review
Track DHCP lease grant rates and flag statistically significant drops
Baseline normal DHCP client traffic to identify volumetric or malformed request anomalies
Alert on crash dumps generated by the DHCP Server process for rapid triage

How to Mitigate CVE-2026-77886

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-77886 to all affected Windows Server hosts running the DHCP Server role
Inventory all systems running the DHCP Server role and prioritize patching for internet-adjacent or high-availability segments
Restrict inbound DHCP traffic to trusted network segments using firewall and switch access controls
Enable service recovery options to auto-restart the DHCP Server service if it terminates unexpectedly

Patch Information

Microsoft released the fix in the September 2026 security update cycle. Consult the Microsoft Security Update Guide entry for CVE-2026-77886 for KB article numbers, affected builds, and installation guidance.

Workarounds

Deploy DHCP snooping on managed switches to filter unauthorized DHCP traffic at the access layer
Configure a redundant DHCP server on unaffected infrastructure to maintain availability during patching windows
Segment DHCP services behind firewalls that restrict UDP port 67 access to authorized VLANs only
Enable Windows Defender Firewall rules limiting inbound DHCP requests to trusted subnets

bash

# Configuration example: restrict DHCP inbound traffic and enable service auto-recovery
New-NetFirewallRule -DisplayName "Restrict DHCP Server Inbound" -Direction Inbound -Protocol UDP -LocalPort 67 -RemoteAddress 10.0.0.0/8 -Action Allow
sc.exe failure DHCPServer reset= 86400 actions= restart/60000/restart/60000/restart/60000