External risk intelligence

Windows DHCP Server Heap Overflow Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-96320

The Windows DHCP Server service is a foundational network protocol component. While it operates over the network, it is typically deployed within internal network segments to serve local clients and is rarely exposed directly to the public internet in standard, secure architecture configurations.

Buffer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Windows DHCP Server could allow an unauthorized attacker to execute code remotely. This issue affects a core network service, and its remote execution capability necessitates understanding its potential reach within our environment. The primary concern is confirming whether our internal networks utilize the affected DHCP Server functionality and assessing any exposure.

A flaw allows remote code execution via DHCP.
Matters because it's a core network service.
Confirm relevance and exposure to our operations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted network request to the Windows DHCP Server. This could allow the attacker to execute arbitrary code on the server, potentially leading to a full system compromise. The specific details of how this request is constructed and delivered are not detailed in the provided information.

Network access to the DHCP Server is required.
A crafted network request triggers the overflow.
Risk of remote code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

An attacker on the network could overflow a buffer in the Windows DHCP Server, potentially leading to code execution. This could affect the availability and integrity of the DHCP service when supported by the advisory.

DHCP service availability and integrity.
Network-based buffer overflow.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Addressing this critical vulnerability in the Windows DHCP Server requires immediate attention from infrastructure and network security teams. The first practical step is to identify all instances of the affected DHCP Server, confirm their network exposure and business criticality, and then locate the accountable owner to begin remediation planning based on assessed risk.

Infrastructure and Network Security teams own this issue.
Verify DHCP Server network exposure and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows DHCP Server and why is it used?

Windows DHCP Server is a foundational network service responsible for automatically assigning IP addresses and network configuration settings to devices. By managing these essential connections, it allows computers, printers, and other hardware to communicate within an organization's network without manual configuration.

What does CWE-122 mean in the context of CVE-2026-96320?

CWE-122 refers to a heap-based buffer overflow. This happens when a program writes more data to a specific area of memory (the heap) than it is designed to hold. In this CVE, the vulnerability allows an attacker to overwhelm the DHCP service's memory, which can cause the system to malfunction or execute unauthorized code.

How is this buffer overflow triggered?

The vulnerability is triggered when an attacker sends a specially crafted network request to the DHCP Server. Note that simply having a DHCP server running does not trigger the bug; the system must receive a malformed packet specifically designed to exploit this memory management flaw.

Do I need to worry about this if my DHCP server is internal?

According to Halo Surface Signal, this service is typically deployed within internal network segments and is rarely exposed to the public internet. While the threat is lower if your server is isolated from external traffic, the risk remains if an attacker gains access to your internal network.

How should I respond to this vulnerability?

The first step is to inventory your environment to identify all active instances of the Windows DHCP Server. Once you have a complete list, assess the network placement and business importance of these systems to prioritize your remediation efforts and coordinate with the appropriate infrastructure owners.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96320

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.