CVE-2026-69405

Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

Scoring

Severity

MEDIUM

CVSS base score

5.7

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE

CWE-401

Published

2026-09-08

Last modified

2026-09-09

Affected products

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 (Server Core installation)
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2012 R2 (Server Core installation)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2016 (Server Core installation)

Weakness type

• CWE-401

Related vulnerabilities

• CVE-2026-69781 — Windows DHCP Client Denial of Service Vulnerability
• CVE-2026-69809 — Windows Active Directory Domain Services Denial of Service Vulnerability
• CVE-2026-69497 — Windows DHCP Server Denial of Service Vulnerability
• CVE-2026-70065 — Windows DHCP Server Denial of Service Vulnerability
• CVE-2026-69588 — Windows TCP/IP Denial of Service Vulnerability
• CVE-2026-16028 — Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
• CVE-2026-18313 — rpcapd memory leak in libpcap before 1.10.7
• CVE-2026-18076 — IBM i is Affected By Multiple Vulnerabilities in Debug Server

Markdown version · Browse all CVEs