This vulnerability is a use‑after‑free bug in Windows DHCP Server that permits an unauthenticated attacker to execute arbitrary code on the target system. The flaw is classified as CWE‑416 and was assigned a CVSS base score of 9.8, indicating critical severity. If successfully exploited, an attacker could gain full control of the machine, compromising confidentiality, integrity, and availability.

Affected are Microsoft Windows 10 version 1607 and 1809, all Windows Server 2012 variants (including Server Core), Windows Server 2012 R2 (including Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Each of these operating systems hosts the DHCP Server service that is vulnerable.

The Windows DHCP Server listens on the network for DHCP requests without authentication, so the vulnerability can be triggered remotely by specially crafted DHCP packets. The exploit does not require prior administrative privileges. Because no EPSS score is published, the current exploitation probability is unknown, but the critical CVSS score and the lack of mitigations imply a high risk. The vulnerability is not listed in CISA’s KEV catalogue, yet organizations should treat it as a high‑threat scenario pending patching.