{"id":"CVE-2026-113863","kind":"vulnerability","aliases":["CVE-2026-113863"],"related":[],"title":"Windows DHCP Client: heap overflow lets an adjacent attacker gain privileges","description":"Heap-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to elevate privileges over an adjacent network.","summary":"A heap-based buffer overflow in the Windows DHCP Client lets an unauthorized attacker on the same network segment elevate privileges. The sources do not say whether a crafted network packet alone is enough or what exact conditions apply.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp","enterprise","infrastructure","windows"],"not_affected_if":["non-windows","static-ip-only"],"how_to_check":"- Check the Windows build version with `winver` and compare it against Microsoft's security update guide for CVE-2026-113863\n- Confirm the DHCP Client service (Dhcp) is running with `sc query Dhcp` on machines that use DHCP","fix":null,"status":"open","published_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:31:45+00:00","updated_at":"2026-11-10T19:31:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:31:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Client: heap overflow lets an adjacent attacker gain privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows DHCP Client lets an unauthorized attacker on the same network segment elevate privileges. The sources do not say whether a crafted network packet alone is enough or what exact conditions apply.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dhcp","enterprise"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker on the local network gains elevated privileges on the machine","analyst_note":"Pull Microsoft's security update guide entry for CVE-2026-113863 to get affected builds, the fixed update, and whether the attack needs a user action or specific network conditions.","how_to_check":"- Check the Windows build version with `winver` and compare it against Microsoft's security update guide for CVE-2026-113863\n- Confirm the DHCP Client service (Dhcp) is running with `sc query Dhcp` on machines that use DHCP","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["static-ip-only","non-windows"],"who_is_affected":"Windows machines that use DHCP to get network addresses are the likely exposure, since the flaw sits in the DHCP Client component. The attacker must be on an adjacent network segment. The sources do not list affected Windows builds or whether any non-default configuration is needed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4504,"output_tokens":566,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Pull Microsoft's security update guide entry for CVE-2026-113863 to get affected builds, the fixed update, and whether the attack needs a user action or specific network conditions.","search":"'-113863':14A,17A '-2026':13A,16A 'adjac':8A,80C 'allow':71C 'alon':54B 'appli':61B 'attack':9A,36B,74C 'base':25B,64C 'buffer':26B,65C 'client':3A,32B,70C 'condit':60B 'craft':51B 'cve':12A,15A 'dhcp':2A,18B,31B,69C 'elev':42B,76C 'enough':56B 'enterpris':19B 'exact':59B 'gain':10A 'heap':4A,24B,63C 'heap-bas':23B,62C 'infrastructur':20B 'let':6A,33B 'network':40B,52B,81C 'overflow':5A,27B,66C 'packet':53B 'privileg':11A,43B,77C 'say':48B 'segment':41B 'sourc':45B 'unauthor':35B,73C 'whether':49B 'window':1A,21B,30B,68C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use DHCP to get network addresses are the likely exposure, since the flaw sits in the DHCP Client component. The attacker must be on an adjacent network segment. The sources do not list affected Windows builds or whether any non-default configuration is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dhcp","enterprise","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-113863':14A,17A '-2026':13A,16A 'adjac':8A 'attack':9A 'client':3A 'cve':12A,15A 'dhcp':2A 'gain':10A 'heap':4A 'let':6A 'overflow':5A 'privileg':11A 'window':1A","search_b":"'alon':54B 'appli':61B 'attack':36B 'base':25B 'buffer':26B 'client':32B 'condit':60B 'craft':51B 'dhcp':18B,31B 'elev':42B 'enough':56B 'enterpris':19B 'exact':59B 'heap':24B 'heap-bas':23B 'infrastructur':20B 'let':33B 'network':40B,52B 'overflow':27B 'packet':53B 'privileg':43B 'say':48B 'segment':41B 'sourc':45B 'unauthor':35B 'whether':49B 'window':21B,30B","search_c":"'adjac':80C 'allow':71C 'attack':74C 'base':64C 'buffer':65C 'client':70C 'dhcp':69C 'elev':76C 'heap':63C 'heap-bas':62C 'network':81C 'overflow':66C 'privileg':77C 'unauthor':73C 'window':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113863","severity":null,"published_at":"2026-11-10T19:19:07+00:00","modified_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}