CVE-2026-70201

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Windows DHCP Server

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70201

EUVD

EUVD-2026-99873

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Windows	Server 2012 6.2.9200.0
Microsoft	Windows	Server 2012 (Server Core installation) 6.2.9200.0
Microsoft	Windows	Server 2012 R2 6.3.9600.0
Microsoft	Windows	Server 2012 R2 (Server Core installation) 6.3.9600.0
Microsoft	Windows	Server 2016 10.0.14393.0
Microsoft	Windows	Server 2016 (Server Core installation) 10.0.14393.0
Microsoft	Windows	Server 2019 10.0.17763.0
Microsoft	Windows	Server 2019 (Server Core installation) 10.0.17763.0
Microsoft	Windows	Server 2022 10.0.20348.0
Microsoft	Windows	Server 2025 10.0.26100.0
Microsoft	Windows	Server 2025 (Server Core installation) 10.0.26100.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds read vulnerability in the Windows DHCP Server. It allows an authorized attacker to cause a denial of service on the local system by exploiting improper memory access.

Impact Analysis

The vulnerability can cause your Windows DHCP Server to stop responding, leading to network disruptions for clients relying on DHCP services. It requires local access and authorization to exploit.

Compliance Impact

This vulnerability allows an authorized attacker to deny service locally through an out-of-bounds read in Windows DHCP Server. While it does not directly impact data confidentiality or integrity, service disruption could affect system availability, which may impact compliance with standards requiring high availability such as HIPAA for healthcare systems or GDPR for data processing operations.

Mitigation Strategies

Apply the latest security updates from Microsoft for Windows DHCP Server to patch the out-of-bounds read vulnerability and prevent denial of service.

Hi! I’m here to help you understand CVE-2026-70201. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70