CVE-2026-44815
CVE-2026-44815 is a critical stack-based buffer overflow in the Windows DHCP Client that lets an unauthenticated attacker execute arbitrary code over the network. It affects multiple releases of Windows 10 and Windows 11, including versions 1607, 1809, 21H2, 22H2, 23H2, 24H2, and 25H2. Although no public exploit or known‑exploited reports are present, the vulnerability remains unpatched in the sources provided.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2).
Real-world impact
An attacker who can send malicious DHCP responses could gain remote code execution with the privileges of the DHCP client service.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…mitigationvendor advisory