The Windows DHCP Server contains an integer underflow that can be exploited by an unauthorized network attacker to read memory across DHCP packets, allowing disclosure of sensitive data from the server. This vulnerability falls under CWE‑125 and CWE‑191 and would compromise confidentiality of configuration and potentially user data.

Microsoft Windows 10 (1607, 1809) and Windows Server (2012 R2, 2016, 2019, 2022, 2025) including Server Core installations, all of which run the affected DHCP Server component.

The CVSS score of 6.5 indicates moderate risk, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a nearby network attacker sending crafted DHCP packets to trigger the integer underflow; no network base privileges are required beyond access to the DHCP traffic.