CVE-2026-77895: Windows DHCP Server DOS Vulnerability

CVE-2026-77895 Overview

CVE-2026-77895 is an out-of-bounds read vulnerability [CWE-125] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated remote attacker can send crafted DHCP traffic to trigger the flaw and deny service to network clients. Microsoft published the advisory through its Security Update Guide.

The vulnerability affects availability only. Successful exploitation does not disclose data or allow code execution, but it can disrupt IP address assignment across an entire network segment. Because DHCP is foundational to most enterprise networks, an outage of this service prevents clients from acquiring or renewing leases.

Critical Impact
Unauthenticated remote attackers can crash the Windows DHCP Server service over the network, disrupting address assignment for all downstream clients.

Affected Products

Microsoft Windows Server with the DHCP Server role enabled
See the Microsoft Security Update Guide for CVE-2026-77895 for the authoritative list of affected builds
No third-party components are documented as affected

Discovery Timeline

2026-09-08 - CVE CVE-2026-77895 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77895

Vulnerability Analysis

The flaw resides in the Windows DHCP Server service, which handles DHCPv4 and DHCPv6 messages on UDP ports 67 and 547. Improper bounds checking on an incoming message field allows the service to read memory outside the intended buffer. The out-of-bounds read triggers an access violation that terminates the DHCP Server process.

Because the attack targets availability, the impact is confined to service disruption. Clients requesting new leases or renewing existing ones will fail once the service crashes. In environments without redundant DHCP scopes, workstations, printers, VoIP phones, and IoT devices lose network connectivity as leases expire.

The EPSS model estimates a 1.149% probability of exploitation within 30 days, placing it above the 64th percentile of scored CVEs.

Root Cause

The root cause is missing or insufficient validation of length or offset values in a DHCP message parser. When the service processes a malformed option, it reads past the end of the allocated buffer. This class of defect is tracked as [CWE-125] Out-of-bounds Read and commonly stems from trusting attacker-supplied length fields without cross-checking against the actual packet size.

Attack Vector

Exploitation requires network access to a Windows DHCP Server. No authentication or user interaction is required. An attacker on the same broadcast domain, or one able to route DHCP traffic to the server, can send a single malformed DHCP packet to trigger the crash. Repeated packets keep the service unavailable if it restarts automatically.

No public proof-of-concept exploit is currently listed for CVE-2026-77895, and the vulnerability is not included on the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for CVE-2026-77895 for vendor guidance.

Detection Methods for CVE-2026-77895

Indicators of Compromise

Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts
Windows Event Log entries showing service crashes, application errors, or Windows Error Reporting events for dhcpssvc.dll or svchost.exe hosting the DHCP role
Spikes in inbound UDP traffic to ports 67 and 547 from unexpected source addresses
Sudden increase in client-side DHCP lease failures or DHCPDISCOVER retransmissions

Detection Strategies

Correlate Windows Service Control Manager events (Event ID 7031, 7034) for the DHCP Server service with network telemetry showing malformed DHCP packets
Deploy network intrusion detection signatures that flag DHCP options with invalid length fields or malformed vendor-specific data
Baseline normal DHCP request volumes per subnet and alert on statistical anomalies

Monitoring Recommendations

Forward DHCP Server operational and audit logs to a central SIEM for correlation with network flow data
Monitor availability of the DHCP Server service with synthetic lease requests from a probe host
Track packet captures on DHCP relay agents to preserve evidence of malformed requests for incident response

How to Mitigate CVE-2026-77895

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-77895 to all Windows Servers running the DHCP Server role
Inventory hosts with the DHCP Server role enabled using Get-WindowsFeature DHCP and prioritize patching
Restrict inbound UDP 67 and 547 traffic to authorized relay agents and client subnets at the network perimeter and internal firewalls
Enable failover or split-scope DHCP configurations so a single service crash does not cause a network-wide outage

Patch Information

Microsoft has released updates addressing CVE-2026-77895 through the standard Windows Update channels. Refer to the Microsoft Security Update Guide for CVE-2026-77895 for the specific KB articles and build numbers that correspond to each supported Windows Server release.

Workarounds

Where patching must be delayed, deploy DHCP failover partners to maintain service availability during a crash
Filter DHCP traffic at Layer 2 using DHCP snooping on managed switches to limit which hosts can send DHCP messages
Segment DHCP servers into management VLANs and restrict relay agents to trusted addresses

bash

# Verify DHCP Server role and configure automatic recovery on service failure
Get-WindowsFeature -Name DHCP
sc.exe failure DHCPServer reset= 86400 actions= restart/60000/restart/60000/restart/60000