CVE-2026-49181 is a high severity integer underflow (CVSS 7.5) in the Windows DHCP Client. Microsoft describes it as allowing an unauthorized attacker to elevate privileges over a network, while the vector shows high confidentiality impact only. Install the Microsoft update for your Windows build.
What's affected
The Windows DHCP Client on Windows 10 versions 1607 and 1809, and Windows Server 2012 through 2025, as the record lists. The list may be partial, and the MSRC page is script driven and did not load text for our review, so check the entry for the full list of builds and updates.
The vector is network based, low complexity, with no privileges or user interaction, and rates confidentiality impact high.
How to check if you're exposed
Windows Update, Microsoft Update Catalog or your patch management tool will show the update for your build. Run winver or Get-ComputerInfo to read the OS version, then find the entry for your build in the MSRC page.
What to do now
- Open the MSRC entry for CVE-2026-49181 and find the update for each build.
- Deploy the update to servers and workstations through your usual patch process.
- Make sure DHCP traffic reaches clients only from your own DHCP servers and relays, using switch features such as DHCP snooping where you have them.
- Check guest and lab networks, where rogue DHCP servers are more likely.
Why it matters
The class is CWE-191, integer underflow, or wraparound. An arithmetic result goes below the smallest value its type can hold and wraps to a large number, which can then be used as a size or an offset. The client processes DHCP replies from the network, so the network is the entry point.
The description says privilege elevation, but the vector shows confidentiality impact only, so we describe it as information exposure and send you to MSRC for the precise wording. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-49181 is a handy place to follow later updates.
Quick check
Who can send DHCP replies to a client?
Any device on the same network segment that can answer broadcasts. That is why rogue DHCP protections help.
Sources
Last reviewed: 19 October 2026.
