CVE-2026-70058 in Windows
Summary
by MITRE • 10/14/2026
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical out-of-bounds write flaw within the Dynamic Host Configuration Protocol server component of Microsoft Windows operating systems. This specific memory corruption issue arises when the DHCP service processes specially crafted network packets that trigger improper boundary checks during data handling operations. An attacker who can send maliciously constructed requests to an affected system over the network can exploit this condition to write data beyond the allocated buffer limits, thereby corrupting adjacent memory structures. The severity of this vulnerability is heightened by its remote exploitable nature and the fact that it requires no user interaction or authentication, allowing any connected entity on the same network segment to attempt exploitation.
From a technical perspective, out-of-bounds writes are among the most dangerous classes of software vulnerabilities because they provide attackers with significant control over memory layout and execution flow. By carefully crafting the payload sent via DHCP requests, an attacker can overwrite critical data structures such as function pointers or exception handlers located in adjacent memory regions. This manipulation allows for arbitrary code execution under the context of the service account running the DHCP server process. In many default configurations, this service runs with high privileges, potentially granting the attacker full control over the compromised system and enabling lateral movement within the network infrastructure.
The operational impact of successfully exploiting this vulnerability is severe, as it leads to complete compromise of the affected Windows host. Once code execution is achieved, an adversary can install malware, create persistent backdoors, exfiltrate sensitive data, or use the machine as a pivot point for further attacks against other systems on the network. Given that DHCP servers are often central infrastructure components responsible for assigning IP addresses and providing essential network configuration parameters to clients, their compromise disrupts both security controls and basic connectivity services. The availability of this vulnerability in widely deployed Windows environments increases the risk profile significantly, as it presents a low-effort attack vector against potentially thousands of systems simultaneously if not properly patched or segmented.
This flaw aligns with Common Weakness Enumeration identifier CWE-787, which classifies out-of-bounds writes that allow attackers to execute arbitrary code. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates initial access through remote services and enables privilege escalation if the service account lacks appropriate least-privilege restrictions. It also supports defense evasion by allowing malware to hide in legitimate system processes and persistence via modification of startup items or scheduled tasks created during exploitation. Mitigation strategies must prioritize immediate patching using official Microsoft security updates that address this specific memory corruption issue. Additionally, network segmentation should be enforced to restrict DHCP traffic to trusted subnets only, reducing the attack surface exposed to potential adversaries. Implementing strict input validation and buffer size checks in custom applications interacting with DHCP services can further reduce risk, although reliance on vendor patches remains the primary defense mechanism against such low-level memory exploitation techniques.