CVE-2026-77886

CVE-2026-77886 is an out-of-bounds read (CWE-125) in the Windows DHCP Server role that Microsoft rates High (CVSS 7.5) with an entirely network-based, unauthenticated attack path. An attacker who can reach the DHCP service can send crafted network input that causes the server to read beyond the intended buffer boundary. The only confirmed impact is denial of service — the confidentiality and integrity impacts are nil, but availability loss is High, meaning the DHCP service can be disrupted and clients may lose address leasing. Any organization running the DHCP Server role on Windows Server is potentially affected; specific affected version ranges were not provided in the available data. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at only 0.8%, indicating no known exploitation to date.

What to do: Install the security update from Microsoft for affected Windows Server versions as soon as it is available in your patch channel. Until patched, restrict reachability of the DHCP Server service to trusted network segments (e.g., limit UDP 67 access and authorized DHCP relay agents) and monitor the service for crashes or abnormal traffic. Note that a successful attack primarily disrupts IP address leasing, so assess the operational impact of DHCP downtime on each site when prioritizing patching.