CVE-2026-118739: Windows DHCP Client Denial of Service Vulnerability

Q: Which systems are exposed to this issue?

Systems running Microsoft Windows 11 or Microsoft Windows Server 2025 with the Windows DHCP Client are affected. Exploitation is possible from an adjacent network rather than requiring Internet-wide reachability.

Q: Does an attacker need credentials or user interaction to trigger the denial of service?

No. The vulnerability is rated as requiring no privileges and no user interaction, with low attack complexity.

Q: What is the expected impact of successful exploitation?

Successful exploitation can deny service by causing a memory-management failure in the Windows DHCP Client. The supplied vector indicates availability impact only, with no stated confidentiality or integrity impact.

Published Nov 10, 2026

Updated

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.

Other sources

Windows DHCP Client Denial of Service Vulnerability

— Microsoft

Affected Software

8 affected componentsFixes available

Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9168, >=10.0.26100<10.0.26100.9106

10.0.26100.916810.0.26100.9106

Microsoft Windows Server 2025<10.0.26100.33296, <10.0.26100.33222

10.0.26100.3329610.0.26100.33222

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.2704

10.0.28000.2704

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.2704

10.0.28000.2704

Microsoft Windows Server 2025<10.0.26100.33296, <10.0.26100.33222

10.0.26100.3329610.0.26100.33222

Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9168, >=10.0.26100<10.0.26100.9106

10.0.26100.916810.0.26100.9106

Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9168, >=10.0.26200<10.0.26200.9106

10.0.26200.916810.0.26200.9106

Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9168, >=10.0.26200<10.0.26200.9106

10.0.26200.916810.0.26200.9106

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9168Fixed in 10.0.26100.9106Patch KB5120994
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33296Fixed in 10.0.26100.33222Patch KB5120228
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2704Patch KB5121000
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9168Fixed in 10.0.26200.9106Patch KB5120994

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running Microsoft Windows 11 or Microsoft Windows Server 2025 with the Windows DHCP Client are affected. Exploitation is possible from an adjacent network rather than requiring Internet-wide reachability.

Does an attacker need credentials or user interaction to trigger the denial of service?

No. The vulnerability is rated as requiring no privileges and no user interaction, with low attack complexity.

What is the expected impact of successful exploitation?

Successful exploitation can deny service by causing a memory-management failure in the Windows DHCP Client. The supplied vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-118739: Windows DHCP Client Denial of Service Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction to trigger the denial of service?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction to trigger the denial of service?

What is the expected impact of successful exploitation?