Microsoft Windows DHCP Client: Denial of service through memory leak

Summary

The Windows DHCP Client, which requests and renews IP configuration on Windows systems, does not release memory after its effective lifetime. An unauthorized attacker on the same adjacent network can exhaust resources and cause a denial of service. No privileges or user interaction are required, and the flaw is not reachable from the internet. The CVSS score is 6.5 (MEDIUM) based on the Microsoft CNA data; NVD analysis was still pending at the time of research.

Affected

• Windows 11 version 24H2: 10.0.26100.0 to before 10.0.26100.9168 (per CVE record)
• Windows 11 version 25H2: 10.0.26200.0 to before 10.0.26200.9168 (per CVE record)
• Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.2704 (per CVE record)
• Windows Server 2025 and Server Core installation: listed by a third-party aggregator only (before 10.0.26100.33296); not confirmed in the CNA record, verify on MSRC
• Windows 10 and Windows Server 2016/2019/2022: not listed in the CNA record found; check MSRC

Fixed in

• Windows 11 24H2: build 10.0.26100.9168 or later (boundary unconfirmed, verify on MSRC)
• Windows 11 25H2: build 10.0.26200.9168 or later (boundary unconfirmed, verify on MSRC)
• Windows 11 26H1: build 10.0.28000.2704 or later (boundary unconfirmed, verify on MSRC)
• Windows Server 2025: build 10.0.26100.33296 or later (unconfirmed)

Workaround

Unknown. No vendor workaround found; patching is the fix.

• General network measures that reduce the ability of adjacent hosts to send DHCP traffic: DHCP snooping and port security on switches, 802.1X on access ports, segmentation of user and guest VLANs (recommendation, not from a source)

Exploitation

• Rapid7 rates exploitation as Less Likely and lists no public disclosure for this CVE (November 2026 Patch Tuesday table)
• CVSS temporal values: E:U (unproven exploit code), RC:C (confirmed)
• No public proof of concept or exploit found
• SSVC: Exploitation none, Automatable no, Technical Impact partial

Our recommendation

• Install the latest cumulative Windows update on all affected systems, and verify on the MSRC advisory which build contains the fix
• Check whether servers, including Windows Server 2025, are affected and patch them
• Restrict adjacent network access: use DHCP snooping, port security and VLAN segmentation, especially for guest networks
• Treat this as a standard-priority patch in the next regular Patch Tuesday cycle
• Re-check NVD and the MSRC advisory later, as NVD analysis and the fix boundaries were not yet confirmed

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-118739 msrc.microsoft.com
• CVE Record CVE-2026-118739 www.cve.org
• Strix: CVE-2026-118739 www.strix.ai
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• KB5121003 release notes (Winaero) winaero.com
• Windows 11 release information (Microsoft Learn) learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:11.