CVE-2026-83665: Windows DHCP Server DOS Vulnerability

CVE-2026-83665 Overview

CVE-2026-83665 is a null pointer dereference vulnerability in Windows DHCP Server that enables an unauthenticated attacker to trigger a denial-of-service condition over the network. The flaw is tracked under CWE-476 and affects the Dynamic Host Configuration Protocol (DHCP) service component on Windows Server platforms. An attacker can send specially crafted DHCP traffic to a vulnerable server to cause the service to crash, interrupting IP address assignment for clients on the network segment.

Critical Impact
Remote, unauthenticated attackers can crash the Windows DHCP Server service, disrupting network address allocation for all dependent clients.

Affected Products

Windows DHCP Server (see Microsoft Security Update Guide for the full version matrix)
Microsoft Windows Server platforms running the DHCP Server role
Refer to the Microsoft Security Update for CVE-2026-83665 for specific affected builds

Discovery Timeline

2026-10-13 - CVE CVE-2026-83665 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-83665

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which handles DHCP requests (DISCOVER, REQUEST, INFORM, RELEASE) from clients on UDP port 67. A null pointer dereference occurs when the service processes a malformed or unexpected DHCP message and attempts to access a pointer that has not been initialized or has been set to null. The resulting access violation terminates the service process, preventing further DHCP lease operations until the service restarts.

Because the attack requires no authentication, no user interaction, and originates over the network, any host able to reach the DHCP Server on its service port can trigger the condition. Successful exploitation does not expose data or allow code execution, but repeated attacks can produce sustained outages for environments that rely on dynamic address assignment.

Root Cause

The root cause is improper validation of input or state within a DHCP message-handling routine, classified under [CWE-476: NULL Pointer Dereference]. A code path dereferences a pointer without first confirming it is non-null, resulting in a crash of the dhcpserver.exe process when the condition is met.

Attack Vector

The attack vector is adjacent-to-network DHCP traffic directed at a vulnerable server. An attacker crafts a DHCP packet that triggers the vulnerable code path and sends it to the DHCP service. No credentials or prior access are required. Microsoft has not published public exploitation details; refer to the Microsoft Security Update Guide for authoritative technical information.

Detection Methods for CVE-2026-83665

Indicators of Compromise

Unexpected termination of the DHCPServer service, with Windows Event Log entries referencing an application fault in dhcpserver.exe.
Service Control Manager events (Event ID 7031 or 7034) indicating the DHCP Server service terminated unexpectedly.
Spikes of malformed or unusually structured DHCP packets arriving on UDP port 67 from a single source.

Detection Strategies

Monitor Windows Event Logs on DHCP servers for application crashes affecting the DHCP service and correlate with inbound network activity.
Deploy network IDS/IPS signatures that identify malformed DHCP messages or protocol anomalies on UDP port 67.
Baseline DHCP service uptime and alert on repeated service restarts, which may indicate exploitation attempts.

Monitoring Recommendations

Enable centralized log collection from all DHCP servers and forward application and system logs to a SIEM for correlation.
Track DHCP lease statistics and client failure rates; sudden drops in successful leases can signal a service outage caused by exploitation.
Capture packet samples from affected servers during crash events to support forensic analysis and signature development.

How to Mitigate CVE-2026-83665

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-83665 to all Windows Servers running the DHCP Server role.
Inventory DHCP servers across the environment and prioritize patching for internet-exposed or shared-network systems.
Review DHCP server event logs for signs of prior crashes that may indicate exploitation attempts.

Patch Information

Microsoft has released an official update addressing CVE-2026-83665. The authoritative patch details, affected builds, and KB article references are available at the Microsoft Security Update Guide. Apply the vendor update through Windows Update, WSUS, or your configuration management platform.

Workarounds

Restrict inbound UDP port 67 traffic to DHCP servers using network segmentation and firewall ACLs, allowing only trusted VLANs or relay agents.
Enable automatic service recovery on the DHCP Server service so the process restarts after a crash, reducing outage duration while patching is scheduled.
Deploy DHCP server redundancy (failover or split-scope) to maintain lease availability if a primary server is impacted.

bash

# Configure the DHCP Server service to restart automatically after failure
sc.exe failure DHCPServer reset= 86400 actions= restart/60000/restart/60000/restart/60000

# Verify current patch level on a Windows Server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10