CVE-2026-62742

The CVSS 6.5 assigned to this integer underflow in Windows DHCP Server option parsing significantly understates the actual risk, and defenders should treat this as a high-severity vulnerability despite the medium score. The underflow occurs in DHCP option parsing code that processes untrusted packets from any host on the adjacent broadcast domain. DHCP operates as a broadcast protocol—every client on a subnet receives offers and acknowledgments from the server, meaning this vulnerability turns a single network service into a distribution vector for whatever memory the underflow exposes. Heap metadata, adjacent structures, potentially credentials or tokens from privileged service contexts, or entropy that enables heap manipulation attacks all fall within the possible disclosure scope. The adjacent-network requirement matters less than the CVSS implies because any attacker who can send DHCP packets to the server—through spoofed requests or rogue responses—already operates within the threat model's implicit trust boundary. This fits a well-documented pattern: Microsoft's DHCP implementation has produced integer overflows, heap corruption, and out-of-bounds reads with notable regularity across multiple CVEs dating back years. The 2026 assignment date is unusual and warrants scrutiny—it suggests either coordinated disclosure still in progress, internal discovery with extended review, or coordination with downstream vendors before public release. Either scenario indicates Microsoft views the finding as more significant than the CVSS reflects. The more dangerous question is whether the underflow can be chained into RCE. Integer underflow in broadcast-protocol parsing is a low-complexity trigger by definition. What takes time to validate is whether the memory disclosure seeds follow-on heap manipulation attacks. The error-handling paths where these underflows typically surface are precisely the code paths that receive minimal testing—written once, touched rarely, executed only when malformed input triggers exception handlers. An attacker with broadcast access has unlimited packets to probe every error path until something wraps. Verify your DHCP server is patched, but also audit which systems on your broadcast domains can send DHCP traffic. Any unpatched Windows DHCP Server in your environment is a known quantity to adversaries now—the disclosure updates their prior on Microsoft's entire DHCP arithmetic layer, and the remediation timeline across enterprise environments creates a compounding window of exposure that the CVSS score entirely obscures.

Reviewed through automated stages and approved by a human before publication.