CVE-2026-77893: Windows DHCP Server DoS Vulnerability

CVE-2026-77893 Overview

CVE-2026-77893 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated remote attacker can trigger a denial-of-service condition by sending crafted network traffic to an affected DHCP Server. Successful exploitation causes the DHCP service to become unresponsive, disrupting IP address assignment for downstream clients. The vulnerability requires no user interaction and no privileges, making it reachable across any network path that permits DHCP traffic to the server.

Critical Impact
Remote, unauthenticated attackers can crash or hang the Windows DHCP Server, preventing new address leases and disrupting network connectivity for all reliant clients.

Affected Products

Windows DHCP Server (see Microsoft advisory for the specific Windows Server builds)
Enterprise Active Directory environments relying on the built-in Windows DHCP role
Network segments dependent on Windows-hosted DHCP scopes for dynamic addressing

Discovery Timeline

2026-09-08 - CVE-2026-77893 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77893

Vulnerability Analysis

The flaw is an out-of-bounds read within the Windows DHCP Server service. When the service parses attacker-controlled DHCP protocol fields, it reads memory outside the bounds of an allocated buffer. The read triggers an access violation that terminates or hangs the DHCP service process, producing a denial-of-service condition.

Because DHCP is a foundational network service, an outage prevents clients from obtaining or renewing IP leases. Existing leases continue to function until expiration, but new device onboarding, lease renewals, and PXE-dependent workflows fail while the service remains down. Repeated exploitation can sustain the outage indefinitely without any credentials on the target.

The vulnerability affects confidentiality and integrity minimally but produces a high impact on availability of the DHCP service itself. Microsoft's advisory is the authoritative source for the affected Windows Server versions and cumulative update identifiers.

Root Cause

The root cause is missing or insufficient bounds validation when the DHCP Server processes fields inside an incoming DHCP message. The parser accesses memory beyond the intended buffer length, producing an out-of-bounds read classified under [CWE-125].

Attack Vector

Exploitation occurs over the network, typically by sending a crafted DHCP packet (UDP/67) to the affected server. No authentication or user interaction is required. Any host with reachability to the DHCP Server's listening port can trigger the condition, including attackers pivoting from a compromised internal endpoint.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Update CVE-2026-77893 advisory for authoritative technical details.

Detection Methods for CVE-2026-77893

Indicators of Compromise

Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts.
Windows Event Log entries indicating access violations or service crashes tied to dhcpssvc.dll or the DHCP Server process.
Sudden spikes in malformed DHCP packets (DISCOVER, REQUEST, INFORM) arriving from a single or spoofed source.
Client-side failures obtaining or renewing DHCP leases coinciding with server-side service faults.

Detection Strategies

Monitor the Windows Service Control Manager for DHCPServer stop, start, and crash events (Event IDs 7031, 7034, 1000).
Enable and forward DHCP audit logs to a centralized SIEM to correlate malformed request patterns with service instability.
Deploy network intrusion detection signatures that flag anomalous DHCP option lengths or malformed field structures on UDP/67.

Monitoring Recommendations

Alert on any unplanned restart of the DHCP Server service in production environments.
Track DHCP lease issuance rates and alert on sudden drops that indicate a service outage.
Baseline expected DHCP client sources and flag traffic from unauthorized subnets or spoofed addresses.

How to Mitigate CVE-2026-77893

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-77893 to all Windows Servers running the DHCP role.
Inventory all Windows DHCP Servers, including those in branch offices and disaster-recovery sites, before scheduling patch deployment.
Restrict UDP/67 and UDP/68 reachability to trusted network segments where DHCP relay or client traffic is legitimately expected.

Patch Information

Microsoft has published a security update addressing this vulnerability. Administrators should consult the Microsoft Security Update CVE-2026-77893 advisory for the applicable KB article and cumulative update identifiers for each supported Windows Server version.

Workarounds

If immediate patching is not feasible, use firewall or ACL rules to limit DHCP traffic to authorized relay agents and client VLANs.
Configure DHCP failover or split-scope deployments so a secondary server can absorb requests if the primary service becomes unavailable.
Monitor DHCP Server service health and configure automatic service recovery to reduce outage duration during exploitation attempts.

bash

# Example: restrict inbound DHCP traffic to authorized relay agents using Windows Firewall
New-NetFirewallRule -DisplayName "Allow DHCP from Relay Agents" -Direction Inbound -Protocol UDP -LocalPort 67 -RemoteAddress 10.0.0.10,10.0.0.11 -Action Allow
New-NetFirewallRule -DisplayName "Block DHCP from Untrusted Sources" -Direction Inbound -Protocol UDP -LocalPort 67 -Action Block

# Configure automatic recovery for the DHCP Server service
sc.exe failure DHCPServer reset= 86400 actions= restart/60000/restart/60000/restart/60000