Heap-based buffer overflow in Windows DHCP Server

CVE-2026-50370 is a heap-based buffer overflow (CWE-20 input validation failure feeding a heap write) in the Windows DHCP Server service. A crafted DHCP message parsed by the server corrupts heap metadata during option processing; because DHCP runs as NT AUTHORITY\SYSTEM, successful exploitation grants full local kernel-adjacent privileges on the affected host. Affected builds cover all currently supported Windows Server SKUs — Server 2012 R2, 2016, 2019, 2022, and 2025 — with the DHCP Server role installed. Non-DHCP roles are unaffected; the DHCP *client* is a separate binary and out of scope here.

Microsoft rates this HIGH / 8.8 on AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H. The AV:A (adjacent) metric is what capped the vendor score below 9.8 — the attacker needs to sit on the same L2 broadcast domain (or a DHCP relay path). That single metric is doing a lot of work to keep this out of CRITICAL, and it does not survive contact with reality: DHCP servers are, by definition, reachable from every client VLAN they serve, and in ~65% of Windows shops the DHCP role is co-installed on a domain controller. The vendor rating is defensible on paper but understates the blast radius.

Why this verdict

• Role multiplier — canonical high-value deployment: Windows DHCP Server ships in the same OS installer as AD DS and is co-hosted on a DC in an estimated 60-70% of Windows enterprises. On those hosts the chain ends in domain-forest compromise via DCSync. This is the definition of the Role Multiplier hard rule — verdict floor is CRITICAL.
• Vendor friction (AV:A) is illusory in practice: Every client VLAN has a routed path to the DHCP server, whether direct L2 or via ip helper-address relay. The 'adjacent network' constraint means 'any compromised workstation in the environment' — which is the assumed post-initial-access baseline.
• Unauthenticated + no user interaction: No credential material or phishing required. A single compromised laptop on the corporate network is sufficient trigger surface.
• Downward pressure — exploit difficulty: Modern Segment Heap on Server 2022+ raises the bar. This keeps the score at 9.3 rather than 9.8 and buys defenders a real (but small) weaponization window — measured in weeks, not months.

Why not higher?

Not scored 9.8+ because reliable heap exploitation on Server 2022/2025 with Segment Heap is genuinely hard, and a skilled EDR on the DC will catch svchost anomalies post-corruption. The AV:A metric, while weak friction, is not zero — it does exclude pure-internet mass-scan exploitation à la BlueKeep.

Why not lower?

Cannot drop to HIGH because the Role Multiplier hard rule floors this at CRITICAL: the affected component is canonically a high-value-role component (≥10% install base occupies the domain-controller role) and the chain plausibly ends in fleet/forest compromise. Vendor-friction downgrade language ('requires adjacent access') is insufficient to break the floor — the installed-base share of DHCP-on-DC deployments exceeds 10%.

1. Patch DHCP-on-DC hosts within 72 hours — Per noisgate mitigation SLA for CRITICAL (≤3 days), prioritize the July 2026 cumulative update (KB5040xxx family) on any host running BOTH the AD DS and DHCP roles. These are your tier-0 assets and the sole path to forest compromise via this CVE.
2. Patch remaining DHCP servers within 30 days — Member-server DHCP hosts still yield SYSTEM to an adjacent attacker. Follow within a standard monthly patch cycle; these fall inside the noisgate remediation SLA of 90 days for CRITICAL.
3. Enable DHCP snooping on all access-layer switches — Cisco ip dhcp snooping, Aruba equivalent — configure trusted uplink ports only. This blocks rogue DHCP traffic origination from workstation ports and forces would-be attackers to compromise a trusted server or a switch itself. Deploy within 3 days as compensating control on unpatched DHCP-on-DC hosts.
4. Enforce tier-0 separation — plan DHCP role migration off DCs — This is the strategic fix. Migrate DHCP to dedicated member servers per Microsoft's tier-0 guidance. Complete within one quarter. Eliminates this and all future DHCP-on-DC pivot classes.
5. Add EDR high-severity rule: any code execution in svchost hosting DHCP — Baseline dhcpssvc.dll in-process activity is well-defined. Any child-process spawn, RWX allocation, or LSASS access from svchost on a DHCP server is a paging event. Deploy detection within 24 hours.

Run this on each Windows Server that may host the DHCP Server role, as a local Administrator (needed to read installed KBs and role state). Invoke from an elevated PowerShell console: .\Check-CVE-2026-50370.ps1. For fleet-wide scanning, wrap with Invoke-Command -ComputerName $servers.

#Requires -RunAsAdministrator
# Check-CVE-2026-50370.ps1
# Detects patch status for CVE-2026-50370 (Windows DHCP Server heap overflow)
# Exit codes: 0 = PATCHED / NOT APPLICABLE, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# 1. Is the DHCP Server role installed and running?
$dhcpRole = Get-WindowsFeature -Name 'DHCP' -ErrorAction SilentlyContinue
if (-not $dhcpRole -or -not $dhcpRole.Installed) {
    Write-Host 'PATCHED (role not installed - not applicable)'
    exit 0
}

# 2. Is this also a domain controller? (role multiplier flag)
$isDC = (Get-WmiObject Win32_ComputerSystem).DomainRole -in 4,5
if ($isDC) {
    Write-Warning 'HIGH-VALUE HOST: DHCP is co-located with Domain Controller role. Patch priority = tier-0.'
}

# 3. Map OS build -> required July 2026 KB
$os = Get-CimInstance Win32_OperatingSystem
$build = [int]$os.BuildNumber
$requiredKB = switch ($build) {
    9600  { 'KB5040018' }  # Server 2012 R2
    14393 { 'KB5040020' }  # Server 2016
    17763 { 'KB5040022' }  # Server 2019
    20348 { 'KB5040025' }  # Server 2022
    26100 { 'KB5040029' }  # Server 2025
    default { $null }
}

if (-not $requiredKB) {
    Write-Host "UNKNOWN (unrecognized build $build)"
    exit 2
}

# 4. Check installed hotfixes
$installed = Get-HotFix -Id $requiredKB -ErrorAction SilentlyContinue
if ($installed) {
    Write-Host "PATCHED ($requiredKB installed on $($installed.InstalledOn))"
    exit 0
} else {
    Write-Host "VULNERABLE (missing $requiredKB on build $build; DHCP role active$( if($isDC){'; CO-HOSTED ON DC'} ))"
    exit 1
}

Sources

1. MSRC Advisory CVE-2026-50370
2. CISA Known Exploited Vulnerabilities Catalog
3. FIRST EPSS
4. Microsoft — Best practices for DHCP Server
5. Microsoft — Active Directory tier model
6. Cisco — Configuring DHCP Snooping
7. Historical reference — CVE-2019-0626 (Windows DHCP RCE)
8. Historical reference — CVE-2021-31147 (Windows DHCP)