An integer underflow (wrap or wraparound) vulnerability exists in the Windows DHCP Server. This flaw can be triggered by an unauthorized attacker on an adjacent network and may expose sensitive information stored in the server’s memory. The weakness corresponds to signed integer underflow (CWE-125) and integer underflow (CWE-191).

The flaw affects Microsoft Windows 10 (Version 1607 and 1809) and Microsoft Windows Server from 2012 through 2025, including all Core installations. Any active DHCP Server instance running these operating systems is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in real‑world scenarios, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is an attacker connected to the same local network segment as the DHCP Server, from which the attacker can transmit malicious requests that trigger the integer underflow and read adjacent data.