IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows DHCP Server: Remote code execution via heap-based buffer overflow

CVE-2026-96320Critical 9.8

← All vulnerabilities

Summary

A heap-based buffer overflow in the Windows DHCP Server role allows an unauthenticated attacker to execute code remotely over the network. The CVSS base score is 9.8 (Critical), while Microsoft rates the flaw as Important. Exploitation requires network access to a DHCP server with the role installed, which is normally limited to the internal LAN.

Affected

  • Windows 10 Version 1607 and 1809 (builds below 10.0.14393.9612 and 10.0.17763.9376)
  • Windows Server 2012 and 2012 R2, including Server Core (builds below 6.2.9200.26434 and 6.3.9600.23470)
  • Windows Server 2016 and 2019, including Server Core (builds below 10.0.14393.9612 and 10.0.17763.9376)
  • Windows Server 2022 (builds below 10.0.20348.5761)
  • Windows Server 2025, including Server Core (builds below 10.0.26100.33650)

Fixed in

  • Windows 10 1607 and Server 2016: 10.0.14393.9612
  • Windows 10 1809 and Server 2019: 10.0.17763.9376
  • Server 2012 and 2012 Server Core: 6.2.9200.26434
  • Server 2012 R2 and Server 2012 R2 Server Core: 6.3.9600.23470
  • Server 2022: 10.0.20348.5761
  • Server 2025: 10.0.26100.33650

Microsoft released the fixes on 13 Oct 2026. KB numbers: Unknown. Obtain them from the MSRC page for each product.

Workaround

  • No vendor workaround found. Unknown.
  • Mitigations not confirmed by the vendor: restrict access to the DHCP service with host or VLAN firewall rules, and remove the DHCP role from hosts that do not need it.

Exploitation

  • Not listed in CISA KEV.
  • CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
  • Microsoft temporal vector: Exploit Code Maturity Unproven (E:U).
  • No public proof of concept found in the research. This does not prove that none exists.

Our recommendation

  • Apply the Microsoft security update for each affected Windows and Windows Server build, starting with servers that run the DHCP role.
  • Check every host for the DHCP Server role, including Windows 10 clients, and identify any unexpected DHCP service.
  • Restrict which hosts can reach the DHCP service with firewall rules, and remove the role where it is not needed.
  • Monitor DHCP logs for unusual activity until patching is complete.
  • Verify Windows 10 1607 support status with Microsoft before advising clients.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Remote code execution – Windows DHCP Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126835, KB5126836, KB5126868, KB5126651, KB5126655, KB5126646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:17.

Original description (NVD)

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed