A heap-based buffer overflow exists in the Windows DHCP Server that permits an unauthenticated attacker to send a specially crafted request across the network and execute arbitrary code. The flaw falls under CWE‑122 and yields a high‑severitiy CVSS score of 9.8, indicating the potential for full system compromise and loss of confidentiality, integrity, and availability.

Affected Microsoft products include Windows 10 Version 1607 and 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022 and 2025, in both standard and Server Core installations. All listed builds must be evaluated for the presence of the vulnerable DHCP service.

The vulnerability can be exploited remotely without authentication by sending malicious DHCP packets to the target server, leveraging the overflow to run code in kernel context. EPSS data is not available, and the issue is not yet catalogued by CISA KEV, but the CVSS rating and lack of authentication requirements combine to create a significant risk for environments that expose DHCP services to untrusted networks.