Windows DHCP Server heap-based buffer overflow — unauthenticated remote code execution

#requires -RunAsAdministrator
# Check-CVE-2026-50518.ps1
# Detects patch state for Windows DHCP Server heap buffer overflow (July 2026)

$ErrorActionPreference = 'Stop'

function Write-Result([string]$state, [string]$msg) {
    Write-Host "[$state] $msg"
    switch ($state) {
        'VULNERABLE' { exit 1 }
        'PATCHED'    { exit 0 }
        default      { exit 2 }
    }
}

# 1) Is DHCP Server role even installed?
try {
    $svc = Get-Service -Name DHCPServer -ErrorAction Stop
} catch {
    Write-Result 'PATCHED' 'DHCP Server role not installed on this host — not applicable.'
}

if ($svc.Status -ne 'Running') {
    Write-Host "[INFO] DHCPServer service present but not running (Status=$($svc.Status))."
}

# 2) Resolve the July 2026 fix KB for this OS build.
#    Update this table from MSRC as new builds are patched.
$build = [System.Environment]::OSVersion.Version.Build
$ubr   = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR
$os    = (Get-CimInstance Win32_OperatingSystem).Caption

# Placeholder mapping — replace <KBxxxxxxx> with the actual July 2026 rollup KB IDs
# from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518
$fixMap = @{
    26100 = 'KB5062553'  # Server 2025 — verify from MSRC
    20348 = 'KB5062554'  # Server 2022 — verify from MSRC
    17763 = 'KB5062555'  # Server 2019 — verify from MSRC
    14393 = 'KB5062556'  # Server 2016 — verify from MSRC
     9600 = 'KB5062557'  # Server 2012 R2 — verify from MSRC
}

if (-not $fixMap.ContainsKey($build)) {
    Write-Result 'UNKNOWN' "Unmapped OS build $build ($os). Check MSRC advisory manually."
}

$targetKb = $fixMap[$build]

# 3) Check installed hotfixes and quick-fix engineering entries
$installed = @()
$installed += (Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID)
try {
    $installed += (Get-WmiObject -Class Win32_QuickFixEngineering -ErrorAction Stop | Select-Object -ExpandProperty HotFixID)
} catch { }

$installed = $installed | Sort-Object -Unique

if ($installed -contains $targetKb) {
    Write-Result 'PATCHED' "$targetKb present on $os (build $build.$ubr)."
} else {
    Write-Result 'VULNERABLE' "$targetKb NOT found on $os (build $build.$ubr). Apply July 2026 rollup."
}