CVE-2026-62714

This integer underflow in the Windows DHCP server occupies a deceptively dangerous position in the vulnerability landscape. The bug likely lives in lease time arithmetic, packet length handling, or transaction state parsing — code paths that process untrusted broadcast input without the defensive programming rigor applied to internet-facing services. It's old code. The DHCP implementation in Windows traces back to NT-era network stack design, and that arithmetic has been there, largely untouched, since the protocol was first implemented. This isn't a novel vulnerability class; it's sediment — accumulated technical debt from an era when adjacency meant a physical Ethernet segment behind a gateway. The CVSS 'adjacent network' vector papers over a critical reality: adjacency in 2026 means a misconfigured VXLAN tunnel, a VPC peering rule, a VPN overlay, or a compromised WiFi access point. The attack surface isn't contained by a physical broadcast domain. What matters is whether the malformed packet reaches the DHCP server's receive handler — and whether that handler assumes bounded input. The 'information disclosure' label is operationally misleading. DHCP leaks network topology, server identities, lease pool boundaries, and relay agent information. That's not a privacy concern — it's reconnaissance infrastructure. The disclosed state directly enables DHCP starvation attacks (because you know the pool limits), rogue server injection (because you know which range to counterfeit), and targeted relay attacks. The MEDIUM score measures the disclosure as an endpoint. It should measure it as the first domino in a documented attack chain. The patch fixes the underflow. The question is whether it hardens the entire wire-format validation layer — length field parsing, bounds checking, transaction state machines — or whether it only patches the specific arithmetic. If it's the latter, expect a close cousin in the next Windows stack revision. The pattern repeats across vendors (ISC dhcpd, Linux kernel clients, dnsmasq) roughly every 18-24 months, in the same logical locations. The genealogy proves the threat model classification is broken. The fix won't change the classification, and the classification determines which code paths get rigorous fuzzing during development. That's the systemic gap this CVE exposes.

Reviewed through automated stages and approved by a human before publication.