Windows DHCP Server: Remote code execution via out-of-bounds write

Summary

A out-of-bounds write in the Windows DHCP Server role allows an unauthorized attacker to execute code over the network. No authentication or user interaction is required, so any host that can send crafted DHCP traffic to the server can attempt the attack. The NVD CVSS vector scores only availability impact (7.5), while the vendor description refers to code execution, so the impact should be treated as potentially code execution.

Affected

• Windows 10 Version 1607: before 10.0.14393.9612
• Windows 10 Version 1809: before 10.0.17763.9376
• Windows Server 2012 (including Server Core): before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): before 6.3.9600.23470
• Windows Server 2016 (including Server Core): before 10.0.14393.9612
• Windows Server 2019 (including Server Core): before 10.0.17763.9376
• Windows Server 2022: before 10.0.20348.5761
• Windows Server 2025 (including Server Core): before 10.0.26100.33650
• Version ranges taken from third-party mirrors of the CVE record; verify against the MSRC page before rollout.

Fixed in

• Microsoft security update of October 2026 for each affected platform.
• Reported update titles for Windows Server 2025 (KB5126646) and Windows 10 1809 (KB5126651) in third-party plugin data; verify on MSRC.
• KB numbers for Windows 10 1607 and Windows Server 2012/2012 R2: Unknown.

Workaround

• No vendor workaround documented. Unknown.
• Interim measure until patched: limit which hosts can reach the DHCP server and use DHCP snooping or network segmentation on switches where possible.

Exploitation

• Not publicly disclosed and not exploited according to MSRC; MSRC rates exploitation as unlikely.
• SSVC data shows exploitation: none and automatable: no, with total technical impact.
• EPSS is about 1.3%.
• No public proof of concept found. Presence in the CISA KEV catalogue: Unverified.

Our recommendation

• Apply the Microsoft security update of October 2026 to all affected Windows DHCP servers.
• Check the MSRC page for exact fixed builds and KB numbers before rollout.
• Verify the support status of Windows 10 1607 and Windows Server 2012/2012 R2; if unsupported, prioritise upgrading over patching.
• Restrict DHCP server access to required hosts, keep DHCP servers off the internet, and monitor DHCP logs for anomalies.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70058 msrc.microsoft.com
• Vulners: CVE-2026-70058 vulners.com
• Tenable Nessus plugin 365473 www.tenable.com
• OpenCVE: CVE-2026-70058 app.opencve.io
• Strix: CVE-2026-70058 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:08.