---
id: "CVE-2026-88240"
page: "https://infrastack.ai/live/CVE-2026-88240"
kind: "vulnerability"
aliases: ["CVE-2026-88240"]
title: "Windows DHCP Client: heap overflow lets a network user gain higher privileges"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows DHCP Client", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adjacent-network", "dhcp", "infrastructure", "privilege-escalation", "windows"]
not_affected_if: ["auth-required"]
published_at: "2026-11-10T19:21:33+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T20:40:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88240", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88240", "first_seen_at": "2026-11-10T20:40:40+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88240"]}]
exploit_sources: []
---

# Windows DHCP Client: heap overflow lets a network user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-88240 (this .md is for agents)

Heap-based buffer overflow (CWE-122) in the Windows DHCP Client. Microsoft rates it Important (CVSS 8.0, adjacent network, low privileges required). An authorized attacker on the same network segment who exploits it could gain SYSTEM. Microsoft says it is not exploited, not publicly disclosed, and Exploitation Less Likely. Fixed in the November 2026 Patch Tuesday release (MSRC lists customer action required).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows DHCP Client affected range not listed fixed no fixed version listed

## How to check

Microsoft's record does not list affected builds or KB numbers. Check the Security Update Guide page for CVE-2026-88240 in a browser and compare it to your installed November 2026 cumulative update (Get-HotFix, or winver and Windows Update history).

## Fix

Install the November 2026 Windows security update for your Windows version (Windows Update). The exact KB and build numbers are not in the machine-readable record; confirm them on the MSRC page.

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88240
- 2026-11-10T20:40:40+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88240 — Read MSRC SUG API record (primary): Important, CVSS 8.0 (AV:A/PR:L), exploited No, not publicly disclosed, Exploitation Less Likely, attacker gains SYSTEM. The record lists no builds or KB numbers; the web UI is JS-only, so affected builds and fixed update are unknown.

## Documents

- [advisory] MSRC Security Update Guide: CVE-2026-88240 Windows DHCP Client EoP https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88240

## From the sources

Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_