CVE-2026-44815: DHCP Client Service Remote Code Execution Vulnerability

Synopsis

Stack-based buffer overflow in the Windows DHCP Client Service allows an unauthenticated remote attacker to execute arbitrary code on affected systems. The vulnerability is reachable over the network with no authentication and no user interaction required, making it exploitable by any attacker who can send crafted DHCP responses to a target host. Successful exploitation gives the attacker full control over the affected system, including the ability to read, modify, or destroy data and disrupt services. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target over the network, specifically by sending malicious DHCP response packets to the vulnerable host.

• AuthenticationNot required

  No credentials or account of any kind are required; the attacker sends unauthenticated network packets to trigger the overflow.

• Victim interactionNot required

  No user action is needed; the DHCP Client Service processes malicious packets automatically without any interaction from a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup beyond network reachability.

Blast Radius

• Attacker executes arbitrary code in the context of the DHCP Client Service, which typically runs with SYSTEM-level privileges on Windows hosts.
• All files, credentials, and secrets stored on the compromised host become readable to the attacker.
• The attacker can modify or delete persisted data, install payloads, or alter system configuration.
• The attacker can crash or disable the host or services running on it, causing a denial of service.