CVE-2026-70065 in Windows
Summary
by MITRE • 09/09/2026
Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified involves a critical resource management flaw within the Dynamic Host Configuration Protocol (DHCP) server component of Microsoft Windows operating systems, specifically categorized under CWE-401: Missing Release of Memory after Effective Lifetime. This defect arises when the DHCP server fails to properly deallocate or release memory resources associated with specific network requests or internal data structures after they have served their intended purpose. In a typical operational scenario, the DHCP server continuously processes incoming lease requests and updates from client devices, allocating temporary buffers for parsing protocol messages and managing state information. When an attacker crafts maliciously formatted packets that trigger this flawed code path, the server allocates memory but neglects to free it upon completion of the request handling process. Over time, as these malformed or high-volume requests are processed, the unreleased memory accumulates in the system's working set, leading to a gradual depletion of available physical and virtual memory resources on the host machine hosting the DHCP service.
The operational impact of this vulnerability is primarily centered around denial of service (DoS), corresponding to ATT&CK technique T1498: Network Denial of Service. As the memory leak progresses, the performance of the Windows DHCP server degrades significantly due to increased paging and resource contention with other system processes. Eventually, the exhaustion of available memory causes the DHCP service to become unresponsive or crash entirely, resulting in a complete loss of IP address assignment capabilities for clients on the network segment served by that specific server. This disruption can halt network connectivity for devices relying on automatic configuration via DHCP, effectively creating a bottleneck that prevents new devices from joining the network and may disrupt ongoing sessions if lease renewals fail due to service instability. The attack vector is remote over the network, requiring no authentication, which allows an unauthorized attacker with basic networking access to exploit this flaw without needing elevated privileges or prior compromise of the target system.
Mitigation strategies for this vulnerability focus on both immediate remediation and long-term architectural resilience. The primary defense involves applying the specific security update provided by Microsoft that addresses the memory management logic within the DHCP server binaries, ensuring that all allocated buffers are correctly freed after use. Organizations should prioritize patching their Windows servers running the DHCP role to eliminate the root cause of the resource leak. In environments where immediate patching is not feasible due to operational constraints, network-level mitigations can be employed to reduce exposure. This includes implementing rate limiting on UDP port 67 and 68 traffic at firewalls or intrusion prevention systems to throttle excessive DHCP request volumes that could accelerate memory exhaustion. Additionally, deploying redundant DHCP servers with load balancing ensures that if one server becomes unresponsive due to the attack, another can continue providing IP configuration services, thereby maintaining network availability despite the partial denial of service condition.