CVE-2026-96320: Windows DHCP Server Buffer Overflow

CVE-2026-96320 Overview

CVE-2026-96320 is a heap-based buffer overflow [CWE-122] in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. The flaw allows an unauthenticated attacker to execute arbitrary code over the network by sending crafted DHCP traffic to a vulnerable server. No user interaction or prior privileges are required, and the attack targets a service commonly exposed on internal network segments.

Critical Impact
Unauthenticated remote code execution against Windows DHCP Server, with full confidentiality, integrity, and availability impact on affected hosts.

Affected Products

Windows DHCP Server (versions enumerated in the Microsoft Security Response Center advisory)
Windows Server deployments running the DHCP Server role
See the Microsoft CVE-2026-96320 Update Guide for the full product and build list

Discovery Timeline

2026-10-13 - CVE-2026-96320 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96320

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Windows DHCP Server service. The service parses DHCP messages from clients during normal lease negotiation. When a malformed or oversized field is processed, the service writes beyond the bounds of a heap allocation. This corruption of adjacent heap memory enables an attacker to influence control flow and achieve arbitrary code execution in the context of the DHCP Server process.

The DHCP Server service typically runs with high privileges on Windows Server systems. Successful exploitation can therefore lead to full system compromise. Because DHCP is foundational to IP address assignment, the service is frequently exposed to broad internal network ranges, increasing exposure.

Root Cause

The root cause is improper validation of attacker-controlled length or offset values before copying data into a fixed-size heap buffer. The condition is classified as [CWE-122], Heap-Based Buffer Overflow. Microsoft has not published implementation-level details beyond the advisory.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. An attacker with network reachability to UDP port 67 on a vulnerable DHCP server can send a crafted packet that triggers the overflow. In segmented environments, exposure is limited to hosts able to reach the DHCP service; in flat networks, any client subnet can originate the attack.

No public proof-of-concept has been published at the time of writing. The EPSS probability is 0.928%. Refer to the Microsoft CVE-2026-96320 Update Guide for authoritative technical details.

Detection Methods for CVE-2026-96320

Indicators of Compromise

Unexpected crashes or restarts of the DHCPServer service recorded in the System event log.
Anomalous DHCP packet volumes or oversized DHCP option fields observed on UDP port 67.
New or unexpected child processes spawned by svchost.exe hosting the DHCP Server service.

Detection Strategies

Monitor for DHCP Server service exceptions, access violations, and Windows Error Reporting entries referencing the DHCP service binary.
Inspect network telemetry for malformed DHCP messages, including options with inconsistent length fields or oversized vendor-specific payloads.
Correlate process creation events on DHCP servers against a known baseline to surface post-exploitation activity.

Monitoring Recommendations

Enable detailed DHCP audit logging and forward logs to a centralized analytics platform.
Alert on outbound connections initiated from DHCP server hosts, which are rarely expected under normal operation.
Track patch compliance for all Windows Server systems running the DHCP Server role.

How to Mitigate CVE-2026-96320

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-96320 Update Guide to all Windows Server hosts running the DHCP Server role.
Inventory all DHCP servers across the environment and prioritize patching for internet-adjacent or untrusted-segment deployments.
Restrict UDP port 67 reachability to only the client subnets that require DHCP services.

Patch Information

Microsoft has released a security update addressing CVE-2026-96320. Patch availability, affected builds, and installation guidance are documented in the Microsoft CVE-2026-96320 Update Guide. Administrators should deploy the update through Windows Update, WSUS, or their standard patch management workflow.

Workarounds

If immediate patching is not feasible, restrict DHCP traffic at the network layer using DHCP snooping and ACLs to limit which hosts can send DHCP messages to the server.
Consider temporarily relocating DHCP services to patched hosts or isolating unpatched DHCP servers from untrusted segments.
Monitor DHCP server telemetry closely until the official update is applied; workarounds do not fully eliminate exploitation risk.

bash

# Example: block inbound DHCP traffic from untrusted subnets on a Windows DHCP server
New-NetFirewallRule -DisplayName "Block DHCP from untrusted subnet" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 67 `
  -RemoteAddress 10.99.0.0/16 `
  -Action Block