The Windows DHCP Server contains an out‑of‑bounds write that can be triggered by a remote attacker who can send crafted DHCP packets to the server. When exploited, the attacker can execute arbitrary code with the privileges of the DHCP service, allowing complete compromise of the affected host. This flaw is classified as CWE‑787 and can lead to confidentiality, integrity, and availability violations for the entire system.

Microsoft Windows 10 Version 1607, Version 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including all Server Core installations that have the DHCP Server role installed. All listed operating systems remain vulnerable until the corresponding Microsoft fix is applied.

The vulnerability has a CVSS score of 7.5, indicating a high potential impact. EPSS score is now 1%, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is over the network: an attacker must send unauthorized DHCP messages to the server to trigger the out‑of‑bounds write. Given the remote code execution nature of the flaw, the risk to any exposed DHCP service is severe, especially for environments that allow DHCP traffic from untrusted sources.