Microsoft Addresses Windows DHCP Server Remote Code Execution Vulnerability
An out-of-bounds write in the Windows DHCP Server allows remote code execution. The issue is tracked as CVE-2026-70058 and is detailed in the Microsoft Security Update Guide.
Key points
- Microsoft addresses CVE-2026-70058, a remote code execution flaw in Windows DHCP Server.
- The vulnerability involves an out-of-bounds write that allows network-based attacks.
- No specific CVSS score or affected version list is detailed in the provided material.
Microsoft has addressed a remote code execution vulnerability within the Windows DHCP Server component. The flaw, identified as CVE-2026-70058, allows an unauthorized attacker to execute code over a network. This issue stems from an out-of-bounds write error in the service handling dynamic host configuration protocol requests. The Microsoft Security Update Guide lists the vulnerability with this specific identifier.
The advisory confirms that the defect permits remote code execution. According to the official summary, an unauthorized attacker can exploit the out-of-bounds write condition to run arbitrary code on the affected system. This capability allows network-based exploitation. The nature of the flaw makes it accessible to remote adversaries via the network.
Context and Background
This update follows recent reports of critical vulnerabilities in other Microsoft components. As this publication reported on October 14, 2026, a critical flaw in Microsoft Office Outlook earned a CVSS 9.8 rating for remote code execution. On the same date, this publication noted a heap-based buffer overflow in the Windows Error Reporting service, which also received a CVSS 9.8 rating. These findings highlight ongoing scrutiny of network-facing services.
The current DHCP issue differs from those previously reported. While the Outlook and Error Reporting flaws were rated critical with specific CVSS scores, the provided material for CVE-2026-70058 does not include a severity rating. The Microsoft advisory focuses solely on the technical description of the out-of-bounds write. No additional context regarding the discovery method or disclosure timeline is included in the source text.
Who is affected
The vulnerability impacts systems running the Windows DHCP Server role. The Microsoft Security Update Guide entry for CVE-2026-70058 does not specify which exact Windows Server versions are vulnerable in the provided summary. Administrators must consult the full update guide to determine if their specific server versions require patching. Any system acting as a DHCP server is potentially at risk until verified.
The provided source material also mentions a separate issue regarding DNS remote code execution. According to Neowin, Microsoft fixed a stack-based buffer overflow in August by limiting recursion depth. The third-party provider 0patch offers protection for legacy Windows Server 2008 R2 and 2012 editions against that DNS flaw. This DNS issue is distinct from the DHCP vulnerability described in the Microsoft advisory.
What should you do?
Administrators should verify whether their Windows Server installations include the DHCP Server role. If the role is active, check for available security updates corresponding to CVE-2026-70058. Apply the latest patches provided by Microsoft to address the out-of-bounds write vulnerability. Ensure that network segmentation limits exposure of DHCP servers to untrusted networks. Monitor for further updates from Microsoft regarding specific version impacts.
What to do and how to stay safe: Microsoft
- Inventory all servers running the Windows DHCP Server role to identify exposure.
- Apply the latest security updates from Microsoft to address CVE-2026-70058.
- Review network configurations to restrict access to DHCP services from untrusted segments.
- Monitor vendor advisories for details on specific affected Windows Server versions.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-70058?
It is a remote code execution vulnerability in the Windows DHCP Server caused by an out-of-bounds write error.
Does this vulnerability affect Windows Outlook or Error Reporting?
No, those are separate vulnerabilities reported on October 14, 2026. This CVE specifically affects the DHCP Server component.
Is there a CVSS score for this DHCP flaw?
The provided source material does not state a CVSS score for CVE-2026-70058.
