Heap-based buffer overflow in Windows DHCP Server

CVE-2026-50518 is a heap-based buffer overflow in the Windows DHCP Server role. The vulnerable code path fails to validate the size of a domain-name field inside an incoming DHCP request/relay message; an attacker on the same broadcast domain (or reachable via a DHCP relay agent) can craft a packet that overwrites heap metadata in the DHCP Server service and pivot to code execution as NT AUTHORITY\SYSTEM. Affects the DHCP Server role on Windows Server 2012 R2 through Windows Server 2025 — the DHCP *Client* is a separate CVE and not in scope here.

The vendor's CVSS 9.8 is *arithmetically* correct — AV:N/AC:L/PR:N/UI:N maps to 9.8 by the book. But the vector is misleading in real deployments: DHCP/UDP-67 is never internet-exposed on a sane network, and Microsoft's own guidance is that the service should live on trusted subnets or behind IP-helper relays. In practice this is an internal, post-initial-access vulnerability that ends in fleet-scale identity leverage. HIGH is the honest bucket; CRITICAL only applies to the negligible fraction of orgs running DHCP on an exposed edge.

Why this verdict

• Reachability collapses the CVSS Network vector. The 9.8 assumes AV:N is meaningful; in practice UDP/67 is L2/relay-scoped, so the attacker is already inside. That's one full severity bucket of adjustment down.
• Role multiplier — standalone DHCP member server: chain ends at SYSTEM on one utility host. Blast radius: host-level. Bad but contained.
• Role multiplier — DHCP co-hosted on a Domain Controller (very common in SMB/mid-market): chain ends in Domain Admin. Blast radius: entire AD forest. This is why the floor stays at HIGH and does not fall to MEDIUM.
• Role multiplier — DHCP standalone but AD-integrated with scope-option control of clients: attacker can push malicious WPAD/DNS/PXE to every client renewal. Blast radius: fleet-wide credential capture / MITM. Also holds the HIGH floor.
• No KEV, no public PoC, no observed campaigns today — pulls urgency down from 'patch tonight' to 'patch within the 30-day HIGH SLA'.
• Exploitation-More-Likely rating from Microsoft + historic precedent (DHCP heap bugs consistently get weaponized within 2 months) keeps this out of the MEDIUM bucket.

Why not higher?

CRITICAL requires either internet-scale reachability (absent — service is never internet-exposed) or an active exploitation campaign (none observed). The chain requires a prior foothold on a serviced subnet or a relay-capable device; that's post-initial-access, which is by definition not CRITICAL for a broadly deployed product. If KEV lists it or a wormable PoC drops, re-rate to CRITICAL immediately.

Why not lower?

MEDIUM is off the table because of the role-multiplier floor: on any co-hosted or AD-integrated deployment the chain terminates in domain compromise or fleet-wide client MITM. Downgrading below HIGH would ignore the deployment-role blast radius rule — a bug in a component that hands DHCP options to every workstation on the network cannot be treated as ordinary hygiene.

1. Enable DHCP snooping on all access switches — Blocks rogue DHCP relay agents and constrains which ports can source DHCP traffic, cutting off the primary lateral-attack vector. Deploy within 30 days per the noisgate HIGH mitigation SLA; most enterprise switch fleets support this natively.
2. Segregate DHCP Server role off any Domain Controller — The single biggest severity multiplier is DHCP-on-DC co-hosting. Move DHCP to a dedicated member server (or DHCP failover pair) so a SYSTEM compromise doesn't equal instant DA. Plan the migration inside the 30-day window even if the patch is applied first — this is a permanent risk reduction.
3. Restrict UDP/67-68 with host firewall to known relay agents — On the DHCP server, use Windows Firewall to accept UDP/67 only from your L3 switch/router relay IPs. Prevents packet delivery from arbitrary compromised endpoints on flat networks. Same 30-day deadline.
4. Turn on DHCP audit logging + forward to SIEM — Look for anomalous option lengths, service crashes (Event 1000/1001 for svchost hosting DHCP), and unexpected scope-option changes. Provides detection coverage until patch rollout completes.
5. Deploy the July 2026 cumulative update to all DHCP servers — Actual remediation. Under the noisgate HIGH remediation SLA the deadline is 180 days, but given the *Exploitation More Likely* rating and DHCP-on-DC prevalence, prioritize within 30–45 days.

Run on each Windows Server with the DHCP Server role, as a local administrator. Example: .\Check-CVE-2026-50518.ps1. It confirms the role is installed, then checks the July 2026 KB is present for the running OS build. Outputs VULNERABLE / PATCHED / UNKNOWN and sets a matching exit code (0/1/2).

#requires -RunAsAdministrator
# Check-CVE-2026-50518.ps1
# Detects patch state for Windows DHCP Server heap buffer overflow (July 2026)

$ErrorActionPreference = 'Stop'

function Write-Result([string]$state, [string]$msg) {
    Write-Host "[$state] $msg"
    switch ($state) {
        'VULNERABLE' { exit 1 }
        'PATCHED'    { exit 0 }
        default      { exit 2 }
    }
}

# 1) Is DHCP Server role even installed?
try {
    $svc = Get-Service -Name DHCPServer -ErrorAction Stop
} catch {
    Write-Result 'PATCHED' 'DHCP Server role not installed on this host — not applicable.'
}

if ($svc.Status -ne 'Running') {
    Write-Host "[INFO] DHCPServer service present but not running (Status=$($svc.Status))."
}

# 2) Resolve the July 2026 fix KB for this OS build.
#    Update this table from MSRC as new builds are patched.
$build = [System.Environment]::OSVersion.Version.Build
$ubr   = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR
$os    = (Get-CimInstance Win32_OperatingSystem).Caption

# Placeholder mapping — replace <KBxxxxxxx> with the actual July 2026 rollup KB IDs
# from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518
$fixMap = @{
    26100 = 'KB5062553'  # Server 2025 — verify from MSRC
    20348 = 'KB5062554'  # Server 2022 — verify from MSRC
    17763 = 'KB5062555'  # Server 2019 — verify from MSRC
    14393 = 'KB5062556'  # Server 2016 — verify from MSRC
     9600 = 'KB5062557'  # Server 2012 R2 — verify from MSRC
}

if (-not $fixMap.ContainsKey($build)) {
    Write-Result 'UNKNOWN' "Unmapped OS build $build ($os). Check MSRC advisory manually."
}

$targetKb = $fixMap[$build]

# 3) Check installed hotfixes and quick-fix engineering entries
$installed = @()
$installed += (Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID)
try {
    $installed += (Get-WmiObject -Class Win32_QuickFixEngineering -ErrorAction Stop | Select-Object -ExpandProperty HotFixID)
} catch { }

$installed = $installed | Sort-Object -Unique

if ($installed -contains $targetKb) {
    Write-Result 'PATCHED' "$targetKb present on $os (build $build.$ubr)."
} else {
    Write-Result 'VULNERABLE' "$targetKb NOT found on $os (build $build.$ubr). Apply July 2026 rollup."
}

Sources

1. MSRC — CVE-2026-50518
2. ZDI — July 2026 Security Update Review
3. SecurityAffairs — July 2026 Patch Tuesday coverage
4. Talos — Microsoft Patch Tuesday July 2026
5. MITRE CVE — DHCP keyword search
6. CISA KEV Catalog
7. Microsoft — Deploy DHCP Server (planning & topology guidance)
8. Cisco — DHCP Snooping configuration guide