A race condition in Windows DHCP Server arises from concurrent execution using a shared resource with improper synchronization. The flaw allows an unauthorized attacker to send crafted network traffic to the DHCP service, triggering the race condition so that malicious code can be executed on the host. The vulnerability directly compromises confidentiality, integrity and availability by permitting an attacker to run arbitrary code on the affected system.

Microsoft Windows 10 Version 1607 and Version 1809, Windows Server 2012 (both normal and Server Core installations), Windows Server 2012 R2 (normal and Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 (both normal and Server Core).

The vulnerability carries a CVSS score of 8.1, indicating high severity. The EPSS score is not available, so the likelihood of exploitation remains uncertain, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the most likely attack vector is a network‑based attack where an adversary sends specially crafted DHCP requests to the vulnerable service. The attacker does not need elevated privileges on the target machine to exploit the race condition and can achieve remote code execution.