---
id: "CVE-2026-88243"
page: "https://infrastack.ai/live/CVE-2026-88243"
kind: "vulnerability"
aliases: ["CVE-2026-88243"]
title: "Windows DHCP Server: out-of-bounds read lets network attacker run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dhcp", "infrastructure", "windows", "windows-server"]
not_affected_if: ["no-dhcp-role", "no-windows-dhcp-server", "windows-client"]
published_at: "2026-11-10T19:21:33+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T19:27:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88243", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-88243", "first_seen_at": "2026-11-10T19:27:06+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-88243", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243"]}]
exploit_sources: []
---

# Windows DHCP Server: out-of-bounds read lets network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-88243 (this .md is for agents)

An out-of-bounds read in the Windows DHCP Server service lets an unauthenticated attacker on the network run code on the server (CVSS 9.8). Microsoft's record lists Windows Server 2016, 2019, 2022 and 2025, including Server Core, and rates exploit code maturity as unproven. Only servers with the DHCP Server role are exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Server 2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run 'Get-WindowsFeature DHCP' in PowerShell: if Installed is True, check the OS build (winver, or CurrentBuildNumber plus UBR in the registry). Vulnerable if the build is below: 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822.

## Fix

Install the November 2026 Windows security update so the build is at least: Server 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822. KB numbers not read (MSRC page did not render).

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88243
- 2026-11-10T19:27:06+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-88243 — Read Microsoft's CNA CVE record (cveawg): CWE-125, CVSS 9.8 (E:U), fixed builds per Windows Server version. MSRC page is JS-only so KB numbers not read; no exploitation or PoC found.

## Documents

- [advisory] CVE-2026-88243 CVE record (Microsoft CNA) https://cveawg.mitre.org/api/cve/CVE-2026-88243
- [fix] MSRC Security Update Guide: CVE-2026-88243 (page is JS-only) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243

## From the sources

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_