This vulnerability is a use‑after‑free in Windows DHCP Server that allows an attacker who can reach the server over the network to execute arbitrary code. The flaw stems from CWE‑416, a memory corruption weakness that can lead to remote code execution with the privileges of the DHCP service, potentially giving the attacker full control of the server. The impact is extended confidentiality, integrity, and availability compromise for the affected host.

The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the Server Core editions of each. All listed Microsoft Windows Server releases that run the Windows DHCP Server role are potentially vulnerable until the corresponding security update is applied.

The CVSS score of 8.1 indicates high severity, and the lack of an available EPSS rating and absence from the KEV catalog mean that the public exploitation status is unclear. The vulnerability requires network access to the DHCP server and does not require authentication, so an unauthenticated remote user could craft malicious DHCP requests and trigger the use‑after‑free. The likely attack vector is over the network via a crafted DHCP request.