CVE-2019-0726: Windows DHCP client memory corruption via crafted DHCP responses

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 9.8 with no privileges or user interaction required and a high EPSS score, though exploitation requires network adjacency to the target's DHCP traffic and no in-the-wild exploitation is documented.

What it is

The Windows DHCP client contains an out-of-bounds write (CWE-787) triggered when it processes specially crafted DHCP responses. A remote attacker on the same network segment can corrupt memory in the client, which Microsoft rates as remote code execution. Because DHCP is used by default on Windows clients and servers, the flaw matters wherever untrusted or attacker-reachable DHCP traffic can reach a host.

Impact

An attacker gains memory corruption in the DHCP client process, which per the vendor advisory can lead to remote code execution in the client's security context. Successful exploitation could allow arbitrary code execution on the affected host.

Attack surface

Reached over the network by sending crafted DHCP responses to a Windows DHCP client; the CVSS vector shows no privileges and no user interaction required. The attacker must be positioned to deliver DHCP responses to the target, typically on the same broadcast domain or via a rogue or compromised DHCP server.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is high at roughly 0.545 (99th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2019-0726 on all affected Windows 10, Windows Server 2016 and Windows Server 2019 systems.
• Segment networks and restrict DHCP traffic so clients only accept responses from authorized DHCP servers (for example via DHCP snooping or port security).
• Disable the DHCP client service on hosts that do not require dynamic addressing, or use static addressing where feasible.
• Monitor for rogue DHCP servers and unauthorized devices on client network segments.

Detection

• Alert on DHCP responses originating from servers or MAC addresses outside the authorized DHCP server inventory.
• Monitor Windows event logs and crash dumps for faults in the DHCP client service (dhcpcsvc) on affected hosts.
• Inspect network traffic for malformed or unusually large DHCP option fields sent to clients.
• Track hosts missing the CVE-2019-0726 patch via vulnerability or patch-management scans.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.