A critical stack-based buffer overflow in the Windows DHCP Client lets an unauthenticated attacker run code remotely over the network, earning a CVSS score of 9.8.
What Is It
CVE-2026-44815 is a stack-based buffer overflow (CWE-121) in the Windows DHCP Client. According to Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low attack complexity, and requiring neither privileges nor user interaction.
Why It Matters
The combination of remote attack vector, no authentication, no user interaction, and full impact across confidentiality, integrity, and availability places this among the most dangerous vulnerability classes. The exploitability sub-score is 3.9 (the maximum) and the impact sub-score is 5.9. Because the DHCP Client participates in routine network address negotiation, a successful exploit could give an attacker code execution on affected systems without any operator action.
No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed in the available source material.
What's Vulnerable
The affected component is the Windows DHCP Client, per the Microsoft advisory issued by [email protected]. The supplied NVD record lists no specific affected CPEs (the configuration set is empty), and the entry remains in "Awaiting Analysis" status as of its publication on 2026-06-09. Consult Microsoft's advisory for the authoritative list of affected products and builds.
Patch Status
The supplied data does not include a CISA KEV required-action or due date. The sole reference is Microsoft's Security Response Center update guide for this CVE, which is the canonical source for patch availability and remediation guidance. Administrators should review that advisory and apply the relevant Microsoft updates for affected Windows versions.
Sources
- MSRC Update Guide; CVE-2026-44815: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44815
- NVD, CVE-2026-44815: https://nvd.nist.gov/vuln/detail/CVE-2026-44815