OnlyPatch
Windows DHCP Server

CVE-2026-50518 — Windows DHCP Server Remote Code Execution Vulnerability

Critical CVSS 9.8 EPSS 0.11058 🔬 Patch diffed 2026-07 archive

Executive Summary

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Overview

9.8
CVSS CRITICAL
Critical
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-122: Heap-based Buffer Overflow
Released Jul 14 2026
Last Updated Jul 14 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.11058 — 0.95521 percentile
NVD CVSS 9.8 CRITICAL — matches MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 8.5

EPSS Score

0.11058
probability of exploitation in the next 30 days
0.95521 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

15 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5099535 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 1607 for x64-based Systems 5099535 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 1809 for 32-bit Systems 5099538 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 1809 for x64-based Systems 5099538 (Security Update) Critical Remote Code Execution Yes
Windows Server 2012 5099445 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 (Server Core installation) 5099445 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 R2 5099444 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 R2 (Server Core installation) 5099444 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2016 5099535 (Security Update) Critical Remote Code Execution Yes
Windows Server 2016 (Server Core installation) 5099535 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 5099538 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 (Server Core installation) 5099538 (Security Update) Critical Remote Code Execution Yes
Windows Server 2022 5099540 (Security Update) Critical Remote Code Execution Yes
Windows Server 2025 5099536 (Security Update) Critical Remote Code Execution Yes
Windows Server 2025 (Server Core installation) 5099536 (Security Update) Critical Remote Code Execution Yes

Patches

6 patches
Article Type Restart
5099535 Security Update Yes
5099538 Security Update Yes
5099445 Monthly Rollup Yes
5099444 Monthly Rollup Yes
5099540 Security Update Yes
5099536 Security Update Yes

Patch Diff

ghidriff · dhcpssvc.dll (KB5099535)

Heap-based buffer overflow (CWE-122) in the Windows DHCP Server Service dhcpssvc.dll punycode DNS-name conversion, unauthenticated remote code execution over the network (Critical, AV:N, CVSS 9.8). The DHCP server parses DHCP options carrying DNS names (client FQDN option / domain search list) in wire/punycode form and converts them to Unicode in DhcpGetUnicodeNameFromWirePunycodeName, which walks the name label-by-label calling ConvertPunycodeToUnicode into a fixed 512-byte (0x200) destination buffer. PRE: the remaining-space accounting was incorrect - the running size was recomputed as remaining = remaining + (remaining>>1)*-2 + 2 instead of being properly decremented per converted label - so a crafted name with enough/long labels could drive the cumulative Unicode output past the end of the destination buffer, a heap overflow. Because the DHCP server processes attacker-supplied packets over the network without authentication, the overflow is an RCE primitive (Microsoft rates it Critical 9.8). Diff of dhcpssvc.dll 10.0.14393.8781 (KB5094122) -> .9339 (KB5099535, Jul 14 2026, Server 2016) confirms the fix: DhcpGetUnicodeNameFromWirePunycodeName (ratio 0.69) is reworked and CFR-gated to decrement the input/output space correctly per label (input_remaining = (input_remaining - 1) - label_len; dst += converted_len) and to check the ConvertPunycodeToUnicode return before advancing, so the accumulated output can no longer exceed the buffer. Lineage note: this is the Server 2016 (14393) pair (winbindex-indexed); the same fix ships across affected DHCP-Server SKUs incl. Server 2025 (26100.33158 / KB5099536), 2019 (KB5099538), 2022 (KB5099540). Surrounding DHCP option parsers (DhcpParseOptionV6, DhcpParseRegistryOption, DhcpGetOptionV6ByOptClass, AddVendorOptDefsFunc*) are hardened in the same update under Feature_661624120.

Pre-patch version 10.0.14393.8781 Download
Post-patch version 10.0.14393.9339 Download
Function Address Change Note
DhcpGetUnicodeNameFromWirePunycodeName code change code (punycode->unicode name-conversion buffer accounting fixed, CFR-gated) Pre: converts a wire/punycode DNS name into a fixed 512-byte buffer with incorrect remaining-space accounting (remaining = remaining + (remaining>>1)*-2 + 2), letting cumulative writes overflow. Post (ratio 0.69, CFR-gated): decrements input/output space correctly per label and checks ConvertPunycodeToUnicode's return before advancing dst.
DhcpParseOptionV6 / DhcpParseRegistryOption / DhcpGetOptionV6ByOptClass / AddVendorOptDefsFunc(6) code change code (DHCP option-parsing hardening in the same update) Related DHCP option/vendor-option parsing routines reworked alongside the name-conversion fix, under Feature_661624120.
Feature_2907675961 / Feature_661624120 gate added (CFR gates) CFR flags gating the corrected name conversion and the broader DHCP option-parsing hardening; the original code ships when disabled.
View full diff report View RCA report

Attack Path

A crafted DHCP DNS-name option overflows the 512-byte punycode-to-unicode conversion buffer on the DHCP server

Attack path for CVE-2026-50518 A crafted DHCP DNS-name option overflows the 512-byte punycode-to-unicode conversion buffer on the DHCP server 01 — ENTRY Unauthenticated attacker sends crafted DHCP traffic to the server dhcpssvc parses DHCP options, including DNS-name options (FQDN / domain search list). AV:N / PR:N / UI:N (network, no auth, UDP/67). 02 — CONTROLLED INPUT Supplies a crafted wire/punycode DNS name The name has enough/long labels that its converted Unicode form exceeds the fixed 512-byte destination buffer. 03 — MISSING CHECK Punycode->unicode conversion overflows the buffer (CWE-122) Pre-patch DhcpGetUnicodeNameFromWirePunycodeName mis-tracks remaining space, so cumulative ConvertPunycodeToUnicode writes overrun the heap buffer. 04 — IMPACT Heap overflow -> remote code execution The out-of-bounds write in the DHCP Server service, reachable unauthenticated over the network, is a Critical (9.8) RCE primitive.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

Detection Rules

Acknowledgments

Amit Schendel with Ventris
Lewis Lee
Owen McCullough with MSRC V&M

On This Page