The vulnerability is a use‑after‑free flaw in the Windows DHCP Server that permits an attacker to execute arbitrary code on the host. By sending specially crafted DHCP requests, an unauthorized network user can trigger the freed memory, leading to remote code execution. The flaw is categorized as CWE‑416.

Affected systems include Microsoft Windows Server versions 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and Server Core configurations. Servers running the DHCP role without the latest patch are potentially compromised.

The CVSS base score is 8.1, indicating a high damage potential. The EPSS score is not available, but the lack of a KEV listing suggests limited public exploitation data. Based on the description, it is inferred that an attacker needs to send specially crafted DHCP requests over the network to trigger the use‑after‑free, and that local privileges are not required, so an attacker on the same subnet could exploit it. The use‑after‑free nature means the daemon’s memory management can be subverted, making the vulnerability serious for systems that rely on the DHCP role.