CVE-2026-69405

medium

Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

Vendor / product: Microsoft — windows 10 1607

Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

CVSS

5.7

5.7 (CVSS v3.1)

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity source: NVD CVSS v3.1 (secure@microsoft.com)

Timeline (UTC)

Published: 2026-09-08 18:19

Modified: 2026-09-24 23:17

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:51 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

microsoft / windows_10_1607 <10.0.14393.9512

microsoft / windows_10_1809 <10.0.17763.9245

microsoft / windows_server_2012 all versions, r2

microsoft / windows_server_2016 <10.0.14393.9512

microsoft / windows_server_2019 <10.0.17763.9245

microsoft / windows_server_2022 <10.0.20348.5622

microsoft / windows_server_2025 <10.0.26100.33438

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

NVD CVE API 2.0 — fetched 2026-10-27 06:51 UTC · record ↗