{"id":"CVE-2026-88243","published":"2026-11-10T19:21:33.783","lastModified":"2026-11-11T05:19:54.337","description":"Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88243","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An out-of-bounds read vulnerability (CWE-125) exists in the Windows DHCP Server, allowing an unauthenticated remote attacker to trigger memory corruption that may lead to arbitrary code execution over the network. The CVSS score of 9.8 reflects high confidentiality, integrity, and availability impact with no authentication or user interaction required.","exploitability":"Exploitation is highly likely due to the network-accessible attack surface, lack of authentication, and low complexity, though successful RCE depends on precise memory layout manipulation.","blast_radius":"Successful exploitation could enable full system compromise of the DHCP server host, potentially allowing attackers to pivot within the network, disrupt IP address allocation, or deploy persistent backdoors.","remediation":"Apply Microsoft security update MS26-XXXX (specific patch not named in description); until then, restrict DHCP server access to trusted subnets via firewall rules and disable unnecessary DHCP services where not required.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","dhcp","memory-corruption","remote-exploit","cwe-125"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:51:44.308Z"}}