External risk intelligence

Windows DHCP Server Out-of-Bounds Read Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-88243

The vulnerability affects the Windows DHCP Server service. While this service operates over the network, it is a foundational infrastructure component typically deployed within internal, protected network segments (LANs) to manage local IP address assignment. It is not designed to be, nor is it commonly configured as, a public-facing internet service.

Out-of-bounds Read

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Windows DHCP Server service, which could allow an unauthorized attacker to execute code remotely over a network. This issue affects a foundational infrastructure component responsible for managing local IP address assignments. The main concern at this time is to confirm the relevance and exposure of this service within our environment.

Remote code execution via Windows DHCP Server.
Critical flaw in core network infrastructure component.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this vulnerability by sending specially crafted network requests to a vulnerable Windows DHCP Server. This could lead to the execution of arbitrary code on the affected server, potentially compromising the entire network.

Network exposure required.
Triggered by sending crafted requests.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthorized attacker to execute code over a network by reading out-of-bounds data in the Windows DHCP Server. This could affect the availability and integrity of the DHCP service itself.

DHCP server functionality.
Network-based code execution.
Service disruption or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Windows DHCP Server's out-of-bounds read vulnerability requires immediate attention from infrastructure and security teams. The first practical step is to identify all instances of the Windows DHCP Server, determine their network exposure, and confirm their criticality to business operations to prioritize remediation. Coordination with the vendor for security updates and planning for their deployment within a maintenance window are essential next steps.

Infrastructure and security teams own this.
Verify DHCP server exposure and criticality.
Plan vendor updates and deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows DHCP Server component?

Windows DHCP Server is a foundational network service that automatically manages the assignment of IP addresses to devices on a network. It acts as the central authority for communication configuration, ensuring that computers, printers, and other hardware can connect to the internal network and communicate with each other correctly.

What does an out-of-bounds read vulnerability mean in CVE-2026-88243?

This vulnerability is classified as CWE-125, which occurs when software reads data past the end of an intended memory buffer. In the context of this CVE, this memory error can be manipulated by an attacker to gain unauthorized control, potentially leading to remote code execution on the server.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network packets to the DHCP service. Simply existing on the same network is not enough; the service must process these specific, malicious requests. Legitimate network traffic, such as standard IP address requests from authorized devices, does not trigger this vulnerability.

Do I need to worry if my DHCP server is internal?

Halo Surface Signal suggests that while the vulnerability is network-based, Windows DHCP Server is typically found in protected internal network segments rather than on the public internet. If your server is isolated from the public internet, the attack surface is significantly reduced compared to internet-facing services.

What should I do first to address this CVE?

Begin by creating an inventory of all Windows DHCP Server instances across your environment. Once identified, verify their network placement and criticality to business operations. Use this data to coordinate with your team to plan for upcoming vendor security updates, ensuring they are tested and applied within a structured maintenance window.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.