{"id":"CVE-2026-88243","kind":"vulnerability","aliases":["CVE-2026-88243"],"related":[],"title":"Windows DHCP Server: out-of-bounds read lets network attacker run code","description":"Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"An out-of-bounds read in the Windows DHCP Server service lets an unauthenticated attacker on the network run code on the server (CVSS 9.8). Microsoft's record lists Windows Server 2016, 2019, 2022 and 2025, including Server Core, and rates exploit code maturity as unproven. Only servers with the DHCP Server role are exposed.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["dhcp","infrastructure","windows","windows-server"],"not_affected_if":["no-dhcp-role","no-windows-dhcp-server","windows-client"],"how_to_check":"Run 'Get-WindowsFeature DHCP' in PowerShell: if Installed is True, check the OS build (winver, or CurrentBuildNumber plus UBR in the registry). Vulnerable if the build is below: 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822.","fix":"Install the November 2026 Windows security update so the build is at least: Server 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822. KB numbers not read (MSRC page did not render).","status":"open","published_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","triaged_at":"2026-11-10T19:25:36+00:00","updated_at":"2026-11-10T19:27:06+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:25:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Server: out-of-bounds read lets network attacker run code","impact":"high","summary":"A memory read past the end of a buffer in the Windows DHCP Server service lets an unauthorized attacker on the network run code. The sources give no further detail on the trigger or the affected Windows versions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dhcp","windows-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated network attacker runs code on the DHCP server","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-88243 for affected builds, the fixed update and whether the DHCP Server role is required.","how_to_check":"- Check whether the server runs the DHCP Server role, for example with `Get-WindowsFeature DHCP` in PowerShell\n- unknown for other checks, the sources do not say which builds are affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dhcp-server"],"who_is_affected":"Only Windows machines running the DHCP Server role are described as affected by the source text. Networks that serve addresses from a Windows DHCP server are the systems to look at; the sources do not name affected builds or versions. Networks that do not run a Windows DHCP server can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4491,"output_tokens":527,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-88243 for affected builds, the fixed update and whether the DHCP Server role is required.","search":"'-2026':15A,18A '-88243':16A,19A '2016':22A,70B '2019':25A,71B '2022':28A,72B '2025':31A,74B '9.8':63B 'allow':103C 'attack':11A,53B,106C 'bound':7A,42B,97C 'code':13A,58B,81B,109C 'core':77B 'cve':14A,17A 'cvss':62B 'dhcp':2A,32B,47B,89B,101C 'execut':108C 'exploit':80B 'expos':93B 'includ':75B 'infrastructur':33B 'let':9A,50B 'list':67B 'matur':82B 'microsoft':64B 'network':10A,56B,112C 'out-of-bound':4A,39B,94C 'rate':79B 'read':8A,43B,98C 'record':66B 'role':91B 'run':12A,57B 'server':3A,21A,24A,27A,30A,37B,48B,61B,69B,76B,86B,90B,102C 'servic':49B 'unauthent':52B 'unauthor':105C 'unproven':84B 'window':1A,34B,36B,46B,68B,100C 'windows':20A,23A,26A,29A 'windows-serv':35B","nicknames":[],"mitigations":[],"who_affected":"Windows Servers that run the DHCP Server role on Windows Server 2016, 2019, 2022 or 2025 (full and Server Core) below the fixed build. Servers without the DHCP Server role, and Windows clients, can skip it. Microsoft's record does not say which network segments can reach the flaw.","tier":"B","verified":{"fix":{"at":"2026-11-10T19:27:06Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243","run_id":2507},"products":{"at":"2026-11-10T19:27:06Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243","run_id":2507},"who_affected":{"at":"2026-11-10T19:27:06Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243","run_id":2507}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2016","server2019","server2022","server2025","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["2016","2019","2022","2025","server","windows"],"labels":["critical","dhcp","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':15A,18A '-88243':16A,19A '2016':22A '2019':25A '2022':28A '2025':31A 'attack':11A 'bound':7A 'code':13A 'cve':14A,17A 'dhcp':2A 'let':9A 'network':10A 'out-of-bound':4A 'read':8A 'run':12A 'server':3A,21A,24A,27A,30A 'window':1A 'windows':20A,23A,26A,29A","search_b":"'2016':70B '2019':71B '2022':72B '2025':74B '9.8':63B 'attack':53B 'bound':42B 'code':58B,81B 'core':77B 'cvss':62B 'dhcp':32B,47B,89B 'exploit':80B 'expos':93B 'includ':75B 'infrastructur':33B 'let':50B 'list':67B 'matur':82B 'microsoft':64B 'network':56B 'out-of-bound':39B 'rate':79B 'read':43B 'record':66B 'role':91B 'run':57B 'server':37B,48B,61B,69B,76B,86B,90B 'servic':49B 'unauthent':52B 'unproven':84B 'window':34B,36B,46B,68B 'windows-serv':35B","search_c":"'allow':103C 'attack':106C 'bound':97C 'code':109C 'dhcp':101C 'execut':108C 'network':112C 'out-of-bound':94C 'read':98C 'server':102C 'unauthor':105C 'window':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88243","severity":null,"published_at":"2026-11-10T19:21:33+00:00","modified_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","fetched_at":"2026-11-10T19:25:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88243:2507","url":"https://cveawg.mitre.org/api/cve/CVE-2026-88243","severity":null,"published_at":"2026-11-10T19:27:06+00:00","modified_at":"2026-11-10T19:27:06+00:00","first_seen_at":"2026-11-10T19:27:06+00:00","fetched_at":"2026-11-10T19:27:06+00:00","note":"Read Microsoft's CNA CVE record (cveawg): CWE-125, CVSS 9.8 (E:U), fixed builds per Windows Server version. MSRC page is JS-only so KB numbers not read; no exploitation or PoC found.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-88243","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243"]}],"documents":[{"id":117530,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-88243","title":"CVE-2026-88243 CVE record (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117531,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243","title":"MSRC Security Update Guide: CVE-2026-88243 (page is JS-only)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}