---
id: "CVE-2026-113863"
page: "https://infrastack.ai/live/CVE-2026-113863"
kind: "vulnerability"
aliases: ["CVE-2026-113863"]
title: "Windows DHCP Client: heap overflow lets an adjacent attacker gain privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dhcp", "enterprise", "infrastructure", "windows", "windows-11"]
not_affected_if: ["non-windows", "patched-build", "static-ip-only"]
published_at: "2026-11-10T19:19:07+00:00"
first_seen_at: "2026-11-10T19:24:43+00:00"
updated_at: "2026-11-10T23:47:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113863", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-113863", "first_seen_at": "2026-11-10T23:47:12+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-113863", "https://radar.offseq.com/threat/cve-2026-113863-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-11-version-24h2-534169ed7c5bc1e7"]}]
exploit_sources: []
---

# Windows DHCP Client: heap overflow lets an adjacent attacker gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-113863 (this .md is for agents)

A heap-based buffer overflow in the Windows DHCP Client lets an unauthorized attacker on the same network segment elevate privileges. The sources do not say whether a crafted network packet alone is enough or what exact conditions apply.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974

## How to check

- Run winver (or [System.Environment]::OSVersion) and compare the full build.revision with the fixed builds: 24H2 < 10.0.26100.9974, 25H2 < 10.0.26200.9974, 26H1 < 10.0.28000.3501, 26H2 < 10.0.26300.9974 are vulnerable.
- Machines with static IPs only and the DHCP Client service (Dhcp) disabled are less likely exposed; check with sc query Dhcp.

## Fix

Install the November 2026 Windows 11 cumulative update: 24H2 to 10.0.26100.9974, 25H2 to 10.0.26200.9974, 26H1 to 10.0.28000.3501, 26H2 to 10.0.26300.9974 (per Microsoft CNA data in NVD).

## Timeline

- 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113863
- 2026-11-10T23:47:12+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-113863 — MSRC page not readable (JS); affected/fixed builds taken from Microsoft CNA data as mirrored by NVD and OffSeq. No exploitation or PoC seen. Nothing marked verified (no vendor page read directly). KB per build and any workaround unknown; MSRC entry would settle.

## Documents

- [advisory] NVD CVE-2026-113863 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-113863
- [mentions] OffSeq Threat Radar CVE-2026-113863 https://radar.offseq.com/threat/cve-2026-113863-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-11-version-24h2-534169ed7c5bc1e7

## From the sources

Heap-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to elevate privileges over an adjacent network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_