Heap-based buffer overflow in Windows DHCP Server

CVE-2026-62823 is a heap-based buffer overflow (CWE-122) in the Windows DHCP Server service. An unauthenticated attacker on an adjacent network segment can send a single crafted DHCP packet to trigger the overflow and achieve arbitrary code execution as SYSTEM. All supported Windows Server releases running the DHCP Server role are affected — Windows Server 2016, 2019, 2022, and 2025. The flaw was patched in Microsoft's August 2026 Patch Tuesday (disclosed 2026-08-11) alongside 13 additional DHCP server vulnerabilities rated Important, making this the highest-severity DHCP fix in the batch. Microsoft's Exploitability Index marks it Exploitation More Likely.

Microsoft's vendor score of 8.8 HIGH is defensible but arguably underweights a critical deployment reality: the CVSS vector uses AV:A (adjacent network), which in pure network terms limits the attacker to L2 adjacency. In practice, however, DHCP relay agents (ip helper-address) forward client DHCP traffic from every client VLAN to the DHCP server as unicast — meaning a crafted DHCP packet originating from *any* relay-served subnet reaches the server. This effectively expands the attack surface well beyond "adjacent." Worse, many enterprises co-locate the DHCP role on Active Directory domain controllers, so RCE here can mean immediate domain compromise. The vendor score is reasonable for a standalone DHCP server on an isolated segment; it understates the risk for the common DC-co-located deployment pattern.

Why this verdict

• AV:A with relay expansion: The CVSS vector specifies adjacent-network access, but DHCP relay agents (configured on virtually every enterprise switch) forward crafted packets from remote VLANs to the DHCP server. The effective attack surface is "any host on any relayed VLAN," not just L2-adjacent hosts.
• Role multiplier: Windows DHCP Server is canonically co-located on domain controllers in a significant share of enterprise deployments (estimated 30–50%). RCE as SYSTEM on a DC = DCSync → Golden Ticket → full domain compromise. This sets a verdict floor of HIGH.
• No public PoC, no KEV, patch-day disclosure: The vulnerability was just disclosed; no weaponized exploit exists publicly. Heap overflows on modern Windows (CFG, ASLR) require non-trivial exploit development, buying defenders a window.
• Exploitation More Likely: Microsoft's own Exploitability Index assessment signals they believe this is reliably exploitable, even without a public PoC. This prevents further downgrade.

Why not higher?

A CRITICAL verdict would require either active exploitation, a public weaponized PoC, or a purely network-reachable (AV:N) attack vector. The AV:A constraint, even weakened by relay, still requires the attacker to already have internal network presence — this is a post-initial-access weapon, not an internet-facing entry point. No KEV listing and no PoC further reduce urgency below CRITICAL.

Why not lower?

Downgrading to MEDIUM would ignore the DC co-location reality that affects a large share of Windows DHCP deployments. DHCP relay effectively negates most of the adjacent-network friction. Microsoft's own "Exploitation More Likely" assessment and the zero-auth, zero-interaction, low-complexity attack profile mean this is a reliable post-access escalation path to domain compromise. The blast radius on high-value targets is too severe for MEDIUM.

1. Separate the DHCP role from domain controllers immediately — If DHCP runs on DCs, migrate it to dedicated member servers or deploy Microsoft DHCP failover on standalone hosts. This eliminates the domain-compromise blast radius. Target completion within the noisgate mitigation SLA of 30 days for HIGH-severity findings.
2. Enable DHCP snooping and rate limiting on all access switches — Configure DHCP snooping on L2 switches to validate DHCP packets and drop malformed options before they reach the server. Rate-limit DHCP traffic per port. This provides a network-layer shield independent of the OS patch.
3. Restrict DHCP relay source VLANs — Audit ip helper-address configurations and remove relay entries from VLANs that do not need DHCP from the affected server (guest, IoT, lab segments). Reducing the number of source VLANs shrinks the attack surface.
4. Deploy IDS/IPS signatures for CVE-2026-62823 — Talos has released Snort rules covering August 2026 Patch Tuesday DHCP vulnerabilities. Deploy these on network sensors monitoring traffic to DHCP servers. This provides detection and, in IPS mode, blocking.
5. Harden DHCP server hosts with attack surface reduction — Enable Windows Defender Credential Guard on Server 2025 DCs to protect credential stores even if SYSTEM is compromised. Ensure CFG and ASLR are not disabled by third-party software on the DHCP server.

Run this script on each Windows Server host that may have the DHCP Server role installed. Execute in an elevated PowerShell session (Run as Administrator). Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-62823.ps1

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the host is vulnerable to CVE-2026-62823 (Windows DHCP Server heap overflow).
.DESCRIPTION
    1. Checks if the DHCP Server role is installed.
    2. Checks if the DHCP Server service is running.
    3. Checks whether the August 2026 Patch Tuesday update is installed.
    Exit codes: 0 = PATCHED or not affected, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Step 1: Check if DHCP Server role is installed
$dhcpFeature = Get-WindowsFeature -Name DHCP -ErrorAction SilentlyContinue
if (-not $dhcpFeature -or $dhcpFeature.InstallState -ne 'Installed') {
    Write-Host 'PATCHED - DHCP Server role is not installed. Not affected by CVE-2026-62823.'
    exit 0
}

# Step 2: Check if DHCP Server service is running
$dhcpService = Get-Service -Name DHCPServer -ErrorAction SilentlyContinue
$serviceRunning = $dhcpService -and $dhcpService.Status -eq 'Running'

# Step 3: Check for August 2026 patches
# August 2026 Patch Tuesday was 2026-08-11. Look for updates installed on or after that date.
$augustPatches = Get-HotFix | Where-Object {
    $_.InstalledOn -ge [datetime]'2026-08-11'
} | Select-Object -ExpandProperty HotFixID

if ($augustPatches.Count -gt 0) {
    $patchList = $augustPatches -join ', '
    Write-Host "PATCHED - August 2026 updates found: $patchList. CVE-2026-62823 is remediated."
    exit 0
}

# Also check via OS build number (August 2026 CU will bump the UBR)
$build = [System.Environment]::OSVersion.Version
$ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR -ErrorAction SilentlyContinue).UBR
Write-Host "Current OS Build: $($build.Major).$($build.Minor).$($build.Build).$ubr"

if ($serviceRunning) {
    Write-Host 'VULNERABLE - DHCP Server role is installed and running. August 2026 patches NOT detected.'
    Write-Host 'ACTION: Apply the August 2026 cumulative update immediately.'
    Write-Host 'WARNING: Check if this DHCP server is co-located on a Domain Controller (heightened risk).'
    # Check DC status
    $isDC = (Get-WmiObject Win32_ComputerSystem).DomainRole -ge 4
    if ($isDC) {
        Write-Host 'CRITICAL FINDING: This host is a Domain Controller running DHCP. Exploitation = domain compromise.'
    }
    exit 1
} else {
    Write-Host 'VULNERABLE - DHCP Server role is installed but service is stopped. August 2026 patches NOT detected.'
    Write-Host 'Risk is reduced while service is stopped, but patch should still be applied.'
    exit 1
}

Sources

1. Cisco Talos — Microsoft Patch Tuesday August 2026
2. Tenable — August 2026 Patch Tuesday Analysis
3. CrowdStrike — August 2026 Patch Tuesday Analysis
4. Lansweeper — Microsoft Patch Tuesday August 2026
5. MSRC — CVE-2026-50518 (related DHCP Server RCE)
6. SANS ISC — Microsoft Patch Tuesday August 2026
7. FIRST — Exploit Prediction Scoring System (EPSS)