CVE-2026-56159
A heap-based buffer overflow in the Windows DHCP Server lets an unauthenticated attacker run arbitrary code over the network. The flaw is rated critical with a CVSS score of 9.8 and affects multiple Windows 10 and Windows Server releases. No official patch, known exploitation, or public exploit is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
Real-world impact
An attacker could exploit this remotely to execute code with the privileges of the DHCP service, potentially leading to full system compromise.
Why this severity
CVSS v3.8. Attack Vector: Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: High, Integrity: High, Availability: High).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…patchvendor advisory