Heap Buffer Overflow RCE in Microsoft Windows DHCP Server
CVSS 3.1
8.8high
EPSS
<1%p50
Published
()
Modified
AI analysis
CVE-2026-62823 is a heap-based buffer overflow (CWE-122) in the Windows DHCP Server service. Because DHCP is an unauthenticated protocol, a low-complexity attack is triggered by sending crafted DHCP traffic to the DHCP server from anywhere on an adjacent network segment (same LAN/broadcast domain) with no credentials or user interaction required. Successful exploitation yields remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8), compromising the host running the DHCP role. Organizations running the DHCP Server role on Windows Server 2012, 2016, 2019, 2022, or 2025, or the listed Windows 10 1607/1809 builds, are affected; since DHCP servers typically sit on internal networks, the primary exposure is to untrusted devices (guests, BYOD, IoT) sharing those LANs rather than the public internet. There is no known exploitation, no public proof-of-concept, and no CISA KEV listing; EPSS is 0.7% (median), and the flaw was among the 974 fixes in Microsoft's record September 2026 Patch Tuesday.
What to do: Apply Microsoft's September 2026 Patch Tuesday security updates to Windows Server 2012/2016/2019/2022/2025 and Windows 10 1607/1809, prioritizing hosts where the DHCP Server role is enabled (inventory via Get-WindowsFeature DHCP or the Microsoft-Windows-DHCP-Server feature). Until patched, restrict DHCP (UDP 67) reachability to trusted network segments and ensure guest, BYOD, and IoT networks do not share a broadcast domain with Windows DHCP servers. There is no public PoC or in-the-wild exploitation reported, but watch vendor advisories since 974 CVEs shipped in this Patch Tuesday cycle.
Affected
microsoft Windows 10 1607
—
microsoft Windows 10 1809
—
microsoft Windows Server 2012
—
microsoft Windows Server 2016
—
microsoft Windows Server 2019
—
microsoft Windows Server 2022
—
microsoft Windows Server 2025
—
Estimated exposure
large~100,000-1,000,000 Windows DHCP server instances across enterprise sites worldwide (deployment-pattern estimate; negligible direct internet exposure) — Windows DHCP is the dominant DHCP implementation on corporate LANs, typically deployed as one or two servers per enterprise site, which suggests an order of magnitude of hundreds of thousands of affected instances, while DHCP being a LAN…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.