Microsoft Windows DHCP Server: Denial of service through null pointer dereference

Summary

A null pointer dereference in the Windows DHCP Server role allows an unauthenticated remote attacker to crash the service over the network, causing a denial of service. The CVSS score is 7.5 (High), and the impact is limited to availability. No public trigger details were found, and CISA SSVC lists exploitation as none.

Affected

• Windows 10 Version 1607 before 10.0.14393.9612
• Windows 10 Version 1809 before 10.0.17763.9376
• Windows Server 2012 and 2012 R2 (including Server Core) before 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2016 and 2019 (including Server Core) before 10.0.14393.9612 and 10.0.17763.9376
• Windows Server 2022 before 10.0.20348.5761
• Windows Server 2025 (including Server Core) before 10.0.26100.33650
• Note: NVD CPE lists only Windows 10 1809; the CNA data lists the products above.

Fixed in

• Install the Microsoft security update for the affected product that brings the build to the versions listed above or later.
• For Windows 10 1809 / Server 2019: KB5126651 (OS Build 17763.9376), released October 13, 2026. Verify on the MSRC page.
• The fix for other products is not confirmed in the research notes; check the MSRC advisory.

Workaround

• No vendor-confirmed workaround. An interim option mentioned by a third-party source is to temporarily disable the DHCP Server service or restrict it; the full guidance could not be verified.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS about 0.013 (low).
• No public proof of concept found. A Tenable entry mentioning exploits refers to the whole update page and could not be confirmed for this CVE.

Our recommendation

• Apply the Microsoft security update for the affected Windows and Windows Server versions as soon as possible.
• Verify the installed build against the MSRC advisory, as the research notes could not confirm all fix details.
• Restrict access to the DHCP service to trusted network segments and monitor for service crashes.
• Do not confuse this CVE with CVE-2026-96951, which is a different vulnerability in the same update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83665 msrc.microsoft.com
• OpenCVE: CVE-2026-83665 app.opencve.io
• Vulners CVE list: CVE-2026-83665 vulners.com
• KB5126651 Microsoft Update Catalog catalog.update.microsoft.com
• NinjaOne KB5126651 overview www.ninjaone.com
• VulDB entry 418756 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:48.