The vulnerability is a use‑after‑free bug in the Windows DHCP Server that allows an attacker who has authorization on the network to execute arbitrary code. The flaw permits malicious code to run in the context of the DHCP service, potentially compromising system confidentiality, integrity, and availability. The weakness is identified as CWE‑416, a classic memory management error that can lead to arbitrary code execution when misused.

Affected products include Microsoft Windows 10 versions 1607 and 1809, as well as Windows Server 2012 through 2025, including core installations. The list of vulnerable models is provided by Microsoft and encompasses all 64‑bit server and 32‑bit desktop builds referenced in the known CNA vendor/product list.

The CVSS score of 6.6 indicates moderate severity, but the possibility of remote code execution elevates the risk profile for environments that host DHCP services. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. The likely attack vector is over the network, requiring the adversary to have some credential or privilege that authorizes them to issue DHCP traffic to the vulnerable server. Once the use‑after‑free condition is triggered, arbitrary code can be executed with the privileges of the DHCP service.