MicrosoftCVE-2026-70250

Microsoft Windows DHCP Client: use after free

CVE-2026-70250 · Published Oct 13, 2026 · updated Oct 28, 2026

High8.8

Fix: upgrade to 6.2.9200.26434 or later (6 fixed versions below)

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.

Affected versions

Package	Affected	Fixed in
Windows Server 2012 Product	>= 6.2.9200.0, < 6.2.9200.26434	6.2.9200.26434
Windows Server 2012 (Server Core installation) Product	>= 6.2.9200.0, < 6.2.9200.26434	6.2.9200.26434
Windows Server 2012 R2 Product	>= 6.3.9600.0, < 6.3.9600.23470	6.3.9600.23470
Windows Server 2012 R2 (Server Core installation) Product	>= 6.3.9600.0, < 6.3.9600.23470	6.3.9600.23470
Windows Server 2016 Product	>= 10.0.14393.0, < 10.0.14393.9612	10.0.14393.9612
Windows Server 2016 (Server Core installation) Product	>= 10.0.14393.0, < 10.0.14393.9612	10.0.14393.9612
Windows Server 2019 Product	>= 10.0.17763.0, < 10.0.17763.9376	10.0.17763.9376
Windows Server 2019 (Server Core installation) Product	>= 10.0.17763.0, < 10.0.17763.9376	10.0.17763.9376
Windows Server 2022 Product	>= 10.0.20348.0, < 10.0.20348.5761	10.0.20348.5761
Windows Server 2025 Product	>= 10.0.26100.0, < 10.0.26100.33650	10.0.26100.33650
Windows Server 2025 (Server Core installation) Product	>= 10.0.26100.0, < 10.0.26100.33650	10.0.26100.33650

Details and references