CVE-2026-77891: Windows DHCP Server RCE Vulnerability

CVE-2026-77891 Overview

CVE-2026-77891 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server. An authorized attacker with high privileges on the local system can leverage the flaw to execute arbitrary code within the DHCP Server process context. Microsoft published the advisory through its Security Update Guide.

The issue requires local access, high attack complexity, and elevated privileges. Despite these constraints, successful exploitation compromises confidentiality, integrity, and availability. The Exploit Prediction Scoring System currently reflects a low probability of exploitation activity in the near term.

Critical Impact
Local code execution within the DHCP Server process, enabling full compromise of the affected Windows Server host.

Affected Products

Microsoft Windows Server with the DHCP Server role enabled
Specific build numbers listed in the Microsoft Security Update Guide
Supported Windows Server versions receiving September 2026 security updates

Discovery Timeline

2026-09-08 - CVE-2026-77891 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-77891

Vulnerability Analysis

The flaw resides in the Windows DHCP Server service, which handles address assignment and lease management for network clients. An out-of-bounds read occurs when the service processes a crafted input structure, allowing the process to reference memory beyond an intended buffer boundary. The condition can be steered to influence execution flow, resulting in local code execution.

Because the DHCP Server service typically runs with elevated system privileges, code execution within its process context grants attackers substantial control over the host. The high attack complexity indicates that reliable exploitation requires specific runtime conditions or race windows. The high privileges requirement means the attacker must already possess an authorized administrative or service-level context on the target host.

Root Cause

The root cause is improper bounds checking [CWE-125] when the DHCP Server reads from a memory buffer. The service does not validate that the read offset remains within the allocated region, permitting adjacent memory to be interpreted as valid data. When combined with attacker-controlled inputs, this behavior can be manipulated to disclose sensitive memory and pivot to code execution.

Attack Vector

Exploitation is local. The attacker must be authenticated on the affected Windows Server host and interact with the DHCP Server process through supported administrative interfaces, RPC channels, or on-host management paths. No user interaction is required. See the Microsoft Security Update Guide for authoritative technical details.

No verified proof-of-concept code is publicly available at the time of publication. Refer to the Microsoft advisory for exploitation constraints.

Detection Methods for CVE-2026-77891

Indicators of Compromise

Unexpected crashes or restarts of the DHCPServer service (dhcpserver.dll, svchost.exe hosting DHCP)
Anomalous child processes spawned by the DHCP Server service context
New or modified DHCP scopes, policies, or filters that do not align with change management records

Detection Strategies

Monitor Windows Event Log channels Microsoft-Windows-Dhcp-Server/Operational and System for service faults and access violation events
Enable process creation auditing (Event ID 4688) to identify unusual descendants of the DHCP Server service
Correlate Windows Error Reporting entries referencing DHCP Server modules with authenticated session activity

Monitoring Recommendations

Baseline normal DHCP Server administrative activity and alert on deviations, including off-hours configuration changes
Track privileged account usage on DHCP-hosting Windows Servers and flag interactive logons on infrastructure roles
Ingest DHCP Server telemetry into a centralized analytics platform for cross-host correlation

How to Mitigate CVE-2026-77891

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-77891
Inventory all Windows Servers with the DHCP Server role and prioritize patching for domain-joined and Tier 0 systems
Restrict administrative access to DHCP servers and enforce just-in-time privilege elevation

Patch Information

Microsoft has issued a security update addressing the out-of-bounds read in the Windows DHCP Server. Administrators should install the update through Windows Update, WSUS, or the standalone package listed in the Microsoft Security Update Guide. Reboot the server after installation to load the patched DHCP Server binaries.

Workarounds

Reduce the number of accounts with local administrative or DHCP Administrators group membership on affected hosts
Isolate DHCP Servers on hardened management networks with restricted inbound administrative access
Enable Windows Defender Credential Guard and LSA protection to limit lateral movement following local compromise

bash

# Verify DHCP Server role and installed updates on Windows Server
Get-WindowsFeature -Name DHCP
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-Service -Name DHCPServer | Format-List Name,Status,StartType