CVE-2026-70069

Summary

A stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute arbitrary code remotely. This vulnerability is particularly dangerous because it can be exploited over the network by authenticated users, potentially leading to full system compromise.

Exploitability

Exploitation requires an authenticated user with access to the DHCP server, which is moderately difficult but achievable in environments where users have legitimate administrative access or through credential compromise.

Blast radius

If exploited, this vulnerability could allow attackers to execute code on the DHCP server, potentially leading to network-wide disruption, lateral movement, and complete control over DHCP services that manage IP address assignments for network clients.

Detection

Monitor for unusual DHCP server process behavior, particularly in the dhcpsrv.exe process, and look for signs of memory corruption or unexpected process restarts that may indicate exploitation attempts.

Prioritized remediation

Deploy the Windows DHCP Server update KB5043172 or later, which contains the patched version of the DHCP service.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.