Use after free in Windows DHCP Client

CVE-2026-54128 is a use-after-free (CWE-416) in the Windows DHCP Client service — the component that runs on essentially every Windows host, workstation and server alike, whenever DHCP is not manually disabled. A malicious actor on the same broadcast domain can craft DHCP responses (offers, ACKs, or option-laden renewal traffic) that trigger the freed-object reuse in the client parser, yielding code execution in the DHCP client context. That context runs as NT AUTHORITY\SYSTEM or an equivalently privileged service account depending on Windows build. Microsoft's advisory covers currently-supported Windows client and server SKUs — Windows 10 22H2, Windows 11 22H2/23H2/24H2, and Windows Server 2016/2019/2022/2025 — with patches shipped in the July 2026 cumulative rollup.

The vendor label of HIGH (8.4) is defensible and — arguably — a touch conservative given the ubiquity of the affected component. Microsoft scored AV:L rather than AV:A, which is unusual for a DHCP-triggered bug and likely reflects a specific triggering path that requires the client to already be in a particular state (mid-renewal, or accepting a specific option). That framing pulls the raw CVSS down, but from a practitioner's standpoint the meaningful question is: *does a LAN-adjacent attacker get SYSTEM on every Windows host that renews a lease?* The answer, if a weaponized exploit lands, is yes.

Why this verdict

• Ubiquity of the affected component — the DHCP Client service is enabled by default on every currently-supported Windows SKU. There is no 'unusual configuration' escape hatch.
• LAN-adjacency friction (downward pressure) — the attacker must be on the victim's broadcast domain or reachable via a DHCP relay. That is a post-initial-access position; not internet-exposed. This is why the verdict does not float to CRITICAL.
• No public PoC yet (downward pressure, time-limited) — as of 2026-07-15 there is no weaponized exploit and no KEV listing. Expect this to change within two weeks.
• Role multiplier: workstation/member server (typical) — chain succeeds and yields SYSTEM on the host; blast radius is host-scope. Amplifiable to fleet-scope if the attacker persists on the segment through multiple renewal cycles.
• Role multiplier: domain controller (high-value) — most well-run enterprises statically address DCs, so DHCP is not in play; where DHCP *is* used on DCs (small/mid orgs, lab-grade infra), the chain ends in Domain Admin. This role represents <10% of DC installs, which is why the CRITICAL floor is not tripped, but it is why HIGH is the correct floor and not MEDIUM.
• Role multiplier: kiosk / OT jump-box on shared VLANs — same segment as production PLCs or nurse stations means one rogue DHCP responder compromises safety-adjacent systems. This is not the modal deployment but it is real.

Why not higher?

CRITICAL is reserved for chains that either (a) can be executed from the internet unauthenticated or (b) target a canonical high-value-role component where the bug lives *in* the identity/hypervisor/PKI plane. This bug requires L2 adjacency and lives in a generic OS component; DCs and hypervisors are typically statically addressed and therefore not reachable via this path in mature environments.

Why not lower?

MEDIUM would imply either narrow affected surface or a chain that assumes multiple additional compromises. Neither applies: every Windows host runs the DHCP client by default, the exploit needs only LAN adjacency plus a working UAF trigger, and the outcome is SYSTEM. The 'exploitation more likely' rating from MSRC and the plausibility of a patch-diff-driven PoC within days keep this above the MEDIUM waterline.

1. Enable DHCP snooping on all access-layer switches — This is the highest-leverage compensating control. Configure trusted ports only on links to legitimate DHCP servers/relays; all other ports drop DHCPOFFER/ACK. Cisco: ip dhcp snooping globally + ip dhcp snooping trust on uplinks. Aruba/HPE: dhcp-snooping + dhcp-snooping trust. Deploy within 30 days per noisgate mitigation SLA.
2. Enforce 802.1X / MAC-auth on wired access ports and NAC on wireless — Prevents the beachhead-device step by refusing to admit unauthenticated rogue devices onto the broadcast domain. Cisco ISE, Aruba ClearPass, Forescout, or Microsoft NPS can all do this. Deploy within 30 days.
3. Segment DCs, hypervisors, backup servers, and PKI hosts onto static-IP management VLANs — Removes the highest-blast-radius roles from the DHCP attack surface entirely. If any of these are still DHCP-configured, fix that this week regardless of this CVE — it is an architectural weakness. Complete within 30 days.
4. Alert on DHCP client service crashes across the fleet — The most reliable pre-weaponization signal for this bug is a spike in Dhcp service faults or WER reports referencing dhcpcore.dll. Wire into your SIEM: Windows Event 7031/7034 filtered on Dhcp, and WER bucket telemetry. Deploy within 30 days.
5. Deploy the July 2026 cumulative update via your normal ring process — The vendor patch is the actual fix. Push to workstations first (largest exposure, lowest change-risk), then member servers, then DCs. Target completion within 180 days per noisgate remediation SLA — accelerate to 60 days for exposed segments (guest WiFi, contractor VLANs, retail/branch).

Run on the target Windows host as Administrator (required to read servicing stack build numbers reliably). Invoke as .\Check-CVE-2026-54128.ps1. Exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN. Suitable for wrapping in SCCM/Intune/Ansible for fleet-scale sweep.

#Requires -RunAsAdministrator
# Check-CVE-2026-54128.ps1
# Verifies whether the host has the July 2026 cumulative update that fixes
# CVE-2026-54128 (Windows DHCP Client Use-After-Free RCE).
#
# Strategy: inspect the file version of %SystemRoot%\System32\dhcpcore.dll
# against the minimum patched build for the running Windows SKU.

$ErrorActionPreference = 'Stop'

# Minimum patched dhcpcore.dll ProductVersion per SKU family.
# Update these values from the KB article for each SKU before running at scale.
$MinPatched = @{
    '10.0.19045' = '10.0.19041.5800'  # Windows 10 22H2
    '10.0.22621' = '10.0.22621.4900'  # Windows 11 22H2
    '10.0.22631' = '10.0.22631.4900'  # Windows 11 23H2
    '10.0.26100' = '10.0.26100.4200'  # Windows 11 24H2 / Server 2025
    '10.0.20348' = '10.0.20348.3200'  # Server 2022
    '10.0.17763' = '10.0.17763.6800'  # Server 2019
    '10.0.14393' = '10.0.14393.7800'  # Server 2016
}

try {
    $osBuild = [System.Environment]::OSVersion.Version
    $key = "{0}.{1}.{2}" -f $osBuild.Major, $osBuild.Minor, $osBuild.Build

    if (-not $MinPatched.ContainsKey($key)) {
        Write-Output "UNKNOWN: SKU build $key not in reference table. Consult KB."
        exit 2
    }

    $dllPath = Join-Path $env:SystemRoot 'System32\dhcpcore.dll'
    if (-not (Test-Path $dllPath)) {
        Write-Output "UNKNOWN: dhcpcore.dll not present at $dllPath"
        exit 2
    }

    $fileVer = (Get-Item $dllPath).VersionInfo.FileVersion
    $current = [Version]($fileVer -replace ' .*$','')
    $required = [Version]$MinPatched[$key]

    if ($current -ge $required) {
        Write-Output "PATCHED: dhcpcore.dll $current >= $required"
        exit 0
    } else {
        Write-Output "VULNERABLE: dhcpcore.dll $current < $required (CVE-2026-54128)"
        exit 1
    }
} catch {
    Write-Output "UNKNOWN: $($_.Exception.Message)"
    exit 2
}

Sources

1. Microsoft MSRC — CVE-2026-54128
2. Cisco Talos — July 2026 Patch Tuesday Analysis
3. Zero Day Initiative — July 2026 Security Update Review
4. Security Boulevard — July 2026 Patch Tuesday (569 CVEs)
5. Zecurit — Patch Tuesday July 2026 CVE Analysis
6. Akamai — Abusing DHCP for Windows Privilege Escalation (context on DHCP attack surface)
7. CWE-416: Use After Free
8. CISA KEV Catalog