9.8 CVSS: Unauthenticated Remote Code Execution via Heap Overflow in Windows DHCP Server

A flaw in the Windows DHCP Server allows an unauthorized attacker to execute code over a network. Microsoft Security Update Guide identifies this issue as CVE-2026-96320. The vulnerability stems from a heap-based buffer overflow. This means an attacker can send malformed data to the server. The server processes this data incorrectly. This error allows the attacker to run arbitrary code on the system. The risk is significant because DHCP servers are often exposed to internal networks. An attacker does not need valid credentials to target the service. The exploit can be launched remotely over the network.

The risk

The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-96320. This rating places the vulnerability in the Critical severity range. The flaw is categorized under CWE-122, which denotes a heap-based buffer overflow. A heap-based buffer overflow occurs when a program writes more data to a memory block than it can hold. In this case, the Windows DHCP Server is affected by this type of error. An unauthorized attacker can craft a malicious request. This request triggers the overflow condition. The attacker can then execute code over a network. The code runs on the affected system. The lack of authentication requirements makes the attack surface broad.

Who is exposed

Any organization running the Windows DHCP Server is potentially exposed to this threat. DHCP servers manage IP address assignments on networks. They are critical infrastructure components in most enterprise environments. Because they listen for network requests, they are often accessible to other devices on the local network. An attacker does not need valid credentials to target the service. The exploit can be launched remotely over the network. This means any device that can reach the DHCP server is a potential threat vector. Internal attackers or compromised endpoints can leverage this flaw. The source material states the attacker is unauthorized.

Cost and compliance

The source material does not specify financial costs or compliance implications. No details about regulatory fines or specific compliance frameworks are provided. The focus remains on the technical nature of the vulnerability. Organizations must assess their own risk tolerance and compliance requirements. They should review their internal security policies regarding DHCP server management. The severity of the flaw suggests a high priority for remediation. However, the material does not outline specific compliance deadlines.

What should you do?

Monitor Microsoft Security Update Guide for official patches related to CVE-2026-96320. Once the vendor provides an update, apply it immediately to all affected Windows DHCP Server instances. Review network access controls to limit exposure of DHCP services to trusted subnets.

The background in plain language

Teams usually secure network services by limiting who can send requests. DHCP is essential for assigning IP addresses to devices. A buffer overflow happens when a program gets more data than it expects. Think of it like pouring too much water into a cup; it spills over. In computing, this spillage can overwrite important data. Attackers use this to trick the computer into running their own commands. It is crucial to keep software updated to fix these memory handling errors. Regular checks for unpatched systems help reduce the chance of such exploits succeeding in your environment.

Background: Unauthenticated remote code execution

Unauthenticated remote code execution allows an attacker to run commands on a server without login credentials. The process begins with network access, moves to input manipulation, triggers a software flaw, and ends with arbitrary command execution. Defenses require strict input validation, minimal service exposure, and runtime protection mechanisms that isolate memory and restrict system calls.

Read the full guide: Unauthenticated Remote Code Execution: How the Attack Works

What to do and how to stay safe: Microsoft

• Verify if your organization runs Windows DHCP Server and check for pending security updates.
• Restrict network access to DHCP servers so only authorized devices can communicate with them.
• Monitor network traffic for unusual DHCP request patterns that might indicate an attack attempt.
• Ensure logging is enabled on DHCP servers to detect potential exploitation attempts early.

Step-by-step guide: Buffer Overflow Prevention Checklist for Secure Code

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96320?

CVE-2026-96320 is a remote code execution vulnerability in the Windows DHCP Server caused by a heap-based buffer overflow.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-96320 as Critical with a CVSS score of 9.8.

Does an attacker need credentials to exploit this flaw?

No, the source material states that an unauthorized attacker can execute code over a network without prior authentication.