External risk intelligence

Windows DHCP Server Use After Free Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72979

The Windows DHCP Server service is a foundational network infrastructure component. While it operates over the network, it is typically deployed within internal network segments to manage local IP addressing and is rarely exposed directly to the public internet in standard deployment configurations.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Windows DHCP Server could allow an unauthorized attacker to execute code remotely over a network. This type of flaw in a core network service warrants careful assessment to understand its potential relevance and impact within our environment. The main concern at this stage is confirming whether our systems are affected and understanding the potential exposure.

Unrestricted network code execution flaw.
Affects core network services.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted network packets to a vulnerable Windows DHCP Server. This could occur if the DHCP Server is exposed to a network segment the attacker can reach. Successful exploitation could lead to the execution of arbitrary code on the affected server.

Network access to the DHCP server is required.
Specially crafted DHCP packets trigger the flaw.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Windows DHCP Server could allow an attacker to execute arbitrary code over a network, potentially impacting the availability and integrity of network services. This could affect systems configured to expose the DHCP server to untrusted networks.

Network services and system integrity.
Unauthenticated network code execution.
Potential for widespread network disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Windows DHCP Server likely impacts infrastructure or platform teams responsible for network services. The immediate priority is to confirm the presence and reachability of the affected DHCP server, identify the business criticality, and determine the accountable owner to plan remediation.

Infrastructure or platform teams own this.
Verify DHCP server exposure and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows DHCP Server and why does it matter?

The Windows DHCP Server is a foundational network service used to automatically assign IP addresses to devices on a network. It acts as a primary manager for network connectivity, ensuring that computers, printers, and other devices can communicate. Because it manages essential infrastructure, vulnerabilities affecting it can impact the stability and security of the entire local network it serves.

What does 'use after free' mean in CVE-2026-72979?

This vulnerability is a 'use after free' memory safety flaw, classified as CWE-416. It occurs when a program continues to use a pointer to a memory location after that memory has been cleared or released. If an attacker can manipulate this process, they may be able to overwrite data or trick the system into running malicious code, essentially confusing the software's memory management.

How is this Windows DHCP Server vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted network packets to the DHCP service. Simply having a device on the network does not trigger it; the attacker must be able to reach the server with these malicious requests. Regular, legitimate DHCP traffic used to assign IP addresses does not cause this memory error.

Do I need to worry if my DHCP server is on an internal network?

According to Halo Surface Signal, this is less likely to be an immediate internet-facing threat. Because DHCP servers are foundational infrastructure, they are typically isolated within internal network segments and rarely exposed to the public internet. You should focus your attention on servers that may have unusual network path configurations that bridge internal services to less trusted areas.

What should I do first to address this CVE?

Start by identifying all systems running the Windows DHCP Server role in your environment. Once you have a list, verify which servers are reachable from untrusted network segments. Prioritize these for review, determine who owns the systems, and coordinate with your infrastructure team to apply the necessary security updates provided by the vendor.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72979

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.