Microsoft Windows DHCP Server: Remote code execution via use after free

Summary

Microsoft has fixed a use-after-free vulnerability (CWE-416) in the Windows DHCP Server role. An unauthenticated attacker with network access can execute code on the server, and the CVSS score is 9.8 (critical). Microsoft rates exploitation as less likely and lists no public disclosure, but DHCP servers reachable from internal segments should be patched as a priority.

Affected

• Windows 10 Version 1607 (CNA data: 10.0.14393.0 to < 10.0.14393.9612; the NVD CPE lists this product)
• Windows 10 Version 1809 (CNA data: 10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2012 and 2012 Server Core (CNA data: 6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and 2012 R2 Server Core (CNA data: 6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 and 2016 Server Core (CNA data: 10.0.14393.0 to < 10.0.14393.9612)
• Windows Server 2019 and 2019 Server Core (CNA data: 10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2022 (CNA data: 10.0.20348.0 to < 10.0.20348.5761)
• Windows Server 2025 and 2025 Server Core (CNA data: 10.0.26100.0 to < 10.0.26100.33650)
• Build numbers are taken from a third-party mirror of the CNA data and must be checked against the MSRC advisory.

Fixed in

• Install the Microsoft security update for October 2026 for each affected version (see the MSRC advisory).
• Fixed builds per CNA data: 10.0.14393.9612 (1607, 2016), 10.0.17763.9376 (1809, 2019), 6.2.9200.26434 (2012), 6.3.9600.23470 (2012 R2), 10.0.20348.5761 (2022), 10.0.26100.33650 (2025).
• KB article numbers: Unknown.

Workaround

Unknown. Microsoft's fix is the update. The reported requirement of failover mode for exploitation is unverified and must not be used as a mitigation.

Exploitation

• Microsoft classifies exploitation as Exploitation Less Likely.
• Microsoft lists the vulnerability as not publicly disclosed, and the temporal vector indicates no public exploit code.
• CISA SSVC data: exploitation none, automatable yes.
• No reports of in-the-wild exploitation were found at the time of research.

Our recommendation

• Identify all hosts with the DHCP Server role and confirm the exact Windows version and build.
• Patch all affected DHCP servers as a priority, starting with 2012, 2016 and 2019 systems and servers in failover pairs.
• Confirm the Windows 10 1607 lifecycle status, as devices may no longer receive security updates.
• Restrict access to the DHCP service with network segmentation and host firewall rules, and keep DHCP servers out of guest, DMZ and internet-facing networks.
• Monitor CISA KEV and vendor updates for signs of exploitation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-96934 msrc.microsoft.com
• Vulners: CVE data mirror (CNA version data) vulners.com
• Strix AI: CVE-2026-96934 www.strix.ai
• Action1: Patch Tuesday October 2026 www.action1.com
• OpenCVE: CVE-2026-96934 (CISA-ADP SSVC) app.opencve.io
• VulDB: CVE-2026-96934 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:14.