CVE-2026-50518
CVE-2026-50518 is a critical heap-based buffer overflow in the Windows DHCP Server that lets an unauthenticated attacker execute arbitrary code over the network. It affects multiple Windows 10 and Windows Server releases, including versions 1607, 1809, 2012 through 2025. No known exploitation in the wild or public exploit is reported, and the sources do not document an official fix.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Windows 10 versions 1607 and 1809, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
Real-world impact
If exploited, an attacker could run code with the privileges of the DHCP service, potentially leading to full system compromise.
Why this severity
The CVSS v3.1 base score is 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…patchvendor advisory