Missing deallocation of memory after the effective lifetime in the Windows DHCP client creates a memory leak that can be exploited to exhaust system resources, preventing the client from properly processing DHCP requests and causing a denial of service. The flaw is a classic memory management error identified by CWE-401. Once triggered, the client cannot recover until the system is rebooted or the service is restarted, affecting network connectivity for the compromised host.

Microsoft Windows 11 (versions 24H2, 25H2, 26H2, 26H1) and Microsoft Windows Server 2025, including Server Core installations, on both ARM64 and x64 architectures are susceptible. Any system running these operating system releases may experience failure of the DHCP client when the flaw is exercised.

The CVSS score of 7.5 signals a high severity for denial of service. EPSS data is unavailable, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be local or remote network-based, relying on crafted DHCP traffic that triggers the memory leak. Because the flaw resides in a core system service, once an attacker can influence DHCP exchanges, the impact is system‑wide for DHCP connectivity, but the difficulty of exploitation depends on network topology and exposure of the DHCP client to untrusted traffic.