OTPulse

Windows DHCP Client Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-62736Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Heap-based buffer overflow in Windows DHCP Client allows a local attacker with user privileges to escalate to system-level access. The vulnerability affects Windows Server 2025 and multiple versions of Windows 11 (23H2, 24H2, 25H2, 26H1) on both x64 and ARM64 architectures. Exploitation is assessed as unlikely. Microsoft has released fixes in the 2026-Aug security update for all affected versions.

What this means
What could happen
A user with local access to a Windows server or workstation could exploit a buffer overflow in the DHCP client to gain system-level privileges, potentially allowing them to modify network configuration, access sensitive data, or run arbitrary commands with elevated permissions.
Who's at risk
Windows Server 2025 and Windows 11 (all recent versions including 23H2, 24H2, 25H2, and 26H1) on x64 and ARM64 systems. This affects any organization running these versions as domain controllers, member servers, or workstations where local users may have access to compromised or untrusted accounts.
How it could be exploited
An attacker with local user privileges exploits a heap-based buffer overflow in the Windows DHCP Client service. The attacker crafts malicious DHCP responses or interacts with the DHCP client to trigger the overflow, allowing them to overwrite memory and execute code with system privileges.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to trigger DHCP client processing (e.g., network reconfiguration or DHCP request)
  • Windows DHCP Client service running (enabled by default)
Requires local authenticationLow complexity attackAllows privilege escalation to system levelAffects multiple Windows versions and platforms
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 23H2 for ARM64-based SystemsAll versionsBuild 10.0.22631.7517
Windows 11 Version 23H2 for x64-based SystemsAll versionsBuild 10.0.22631.7517
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9106
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9168
Windows Server 2025All versionsBuild 10.0.26100.33296
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-Aug security update from Microsoft for your Windows Server and Windows 11 version
Long-term hardening
0/1
HARDENINGIf immediate patching is not possible, restrict local user account creation and review active local accounts for necessity
View full vendor advisory
API: /api/v1/advisories/b2b43c7f-6ce4-4db8-a3e3-e77c318363ac

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.