CVE-2026-88243

Summary

An out-of-bounds read vulnerability (CWE-125) exists in the Windows DHCP Server, allowing an unauthenticated remote attacker to trigger memory corruption that may lead to arbitrary code execution over the network. The CVSS score of 9.8 reflects high confidentiality, integrity, and availability impact with no authentication or user interaction required.

Exploitability

Exploitation is highly likely due to the network-accessible attack surface, lack of authentication, and low complexity, though successful RCE depends on precise memory layout manipulation.

Blast radius

Successful exploitation could enable full system compromise of the DHCP server host, potentially allowing attackers to pivot within the network, disrupt IP address allocation, or deploy persistent backdoors.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply Microsoft security update MS26-XXXX (specific patch not named in description); until then, restrict DHCP server access to trusted subnets via firewall rules and disable unnecessary DHCP services where not required.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.