CVE-2026-69405: CWE-401: Missing Release of Memory after Effective Lifetime in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69405) involves a missing release of memory after its effective lifetime in the Windows DHCP Server component. The affected Windows versions include 10.0.14393 up to but not including 10.0.14393.9512, 10.0.17763 up to 10.0.17763.9245, 6.2.9200 up to 6.2.9200.26349, 6.3.9600 up to 6.3.9600.23398, 10.0.20348 up to 10.0.20348.5622, and 10.0.26100 up to 10.0.26100.33438. The flaw allows an authorized attacker to cause a denial of service by exhausting memory on an adjacent network. The CVSS v3.1 vector indicates the attack requires adjacent network access, low complexity, low privileges, no user interaction, and impacts availability only. Microsoft has issued an official fix for this vulnerability.

An authorized attacker with access to an adjacent network can exploit this vulnerability to cause a denial of service by triggering memory exhaustion in the Windows DHCP Server. There is no impact on confidentiality or integrity, only availability is affected.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69405. No additional mitigation actions are indicated by the vendor advisory.