A heap-based buffer overflow flaw (CWE‑122) in the Windows DHCP Server allows an unauthorized attacker to execute arbitrary code on the server. The vulnerability arises from improper handling of memory when processing DHCP packets, and it also involves deficient input validation (CWE‑20).

Microsoft Windows 10 versions 1607 and 1809, and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 – including their Server Core installations – are affected.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% reflects a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker can send crafted DHCP requests from an adjacent network to trigger the buffer overflow; no local privileges are required. Successful exploitation would grant remote code execution on the target system.