A null pointer dereference has been discovered in the Windows DHCP Server that allows an unauthorized attacker to cause a denial of service over the network. The flaw can lead to a loss of availability for the DHCP service, preventing new client leases and potentially disrupting all network connectivity that relies on DHCP provisioning. This vulnerability is consistent with CWE-476, where an object reference is unexpectedly null. The impact is limited to availability, but a prolonged outage can have cascading effects on business operations and user access to network resources.

Microsoft Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including both standard and Server Core installations, all of which run the Windows DHCP Server component. These systems are potentially exposed wherever DHCP traffic is processed.

The CVSS v3 score of 7.5 indicates a high severity of the vulnerability. The EPSS score of 1% indicates a low exploitation probability, but the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based, requiring the attacker to send a specially crafted DHCP packet to the target server. Because a null pointer dereference typically triggers a crash or forced restart of the process, an adversary can consistently disrupt service with repeated requests. Given the lack of a public exploit proof, exploitation risk may be moderate but remains significant for exposed DHCP services.