{"id":"CVE-2026-105560","kind":"vulnerability","aliases":["CVE-2026-105560"],"related":[],"title":"Windows DHCP Server: invalid pointer release lets an authorized user run code","description":"Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network.","summary":"A flaw in the Windows DHCP Server service lets an authorized attacker release an invalid pointer or reference over the network. The sources say this allows code execution on the server.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp","infrastructure","windows","windows-server"],"not_affected_if":["dhcp-client-only","dhcp-role-not-installed"],"how_to_check":"- Check whether the DHCP Server role is installed on the Windows server (Server Manager or `Get-WindowsFeature DHCP`).\n- Confirm the Windows build level against Microsoft's security update guide for this CVE; the sources do not list affected builds.","fix":null,"status":"open","published_at":"2026-11-10T19:17:58+00:00","first_seen_at":"2026-11-10T19:24:20+00:00","triaged_at":"2026-11-10T19:47:56+00:00","updated_at":"2026-11-10T19:47:56+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:47:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Server: invalid pointer release lets an authorized user run code","impact":"high","summary":"A flaw in the Windows DHCP Server service lets an authorized attacker release an invalid pointer or reference over the network. The sources say this allows code execution on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","dhcp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the DHCP server over the network","analyst_note":"Check the Microsoft security update guide for CVE-2026-105560 for affected Windows builds and the patch KB; the sources give no fix.","how_to_check":"- Check whether the DHCP Server role is installed on the Windows server (Server Manager or `Get-WindowsFeature DHCP`).\n- Confirm the Windows build level against Microsoft's security update guide for this CVE; the sources do not list affected builds.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["dhcp-role-not-installed","dhcp-client-only"],"who_is_affected":"Only Windows servers running the DHCP Server role are exposed. The attacker must already be authorized on the network, so servers without the role can skip it. The sources do not list affected Windows builds or a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4492,"output_tokens":517,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide for CVE-2026-105560 for affected Windows builds and the patch KB; the sources give no fix.","search":"'-105560':15A,18A '-2026':14A,17A 'allow':50B,66C 'attack':36B,69C 'author':9A,35B,68C 'code':12A,51B,72C 'cve':13A,16A 'dhcp':2A,19B,30B,64C 'execut':52B,71C 'flaw':26B 'infrastructur':20B 'invalid':4A,39B,58C 'let':7A,33B 'network':45B,75C 'pointer':5A,40B,59C 'refer':42B,61C 'releas':6A,37B,56C 'run':11A 'say':48B 'server':3A,24B,31B,55B,65C 'servic':32B 'sourc':47B 'user':10A 'window':1A,21B,23B,29B,63C 'windows-serv':22B","nicknames":[],"mitigations":[],"who_affected":"Only Windows servers running the DHCP Server role are exposed. The attacker must already be authorized on the network, so servers without the role can skip it. The sources do not list affected Windows builds or a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dhcp","high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-105560':15A,18A '-2026':14A,17A 'author':9A 'code':12A 'cve':13A,16A 'dhcp':2A 'invalid':4A 'let':7A 'pointer':5A 'releas':6A 'run':11A 'server':3A 'user':10A 'window':1A","search_b":"'allow':50B 'attack':36B 'author':35B 'code':51B 'dhcp':19B,30B 'execut':52B 'flaw':26B 'infrastructur':20B 'invalid':39B 'let':33B 'network':45B 'pointer':40B 'refer':42B 'releas':37B 'say':48B 'server':24B,31B,55B 'servic':32B 'sourc':47B 'window':21B,23B,29B 'windows-serv':22B","search_c":"'allow':66C 'attack':69C 'author':68C 'code':72C 'dhcp':64C 'execut':71C 'invalid':58C 'network':75C 'pointer':59C 'refer':61C 'releas':56C 'server':65C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105560","severity":null,"published_at":"2026-11-10T19:17:58+00:00","modified_at":"2026-11-10T19:17:58+00:00","first_seen_at":"2026-11-10T19:24:20+00:00","fetched_at":"2026-11-10T19:24:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}