CVE-2026-77889: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in Microsoft Windows 10 Version 1607

CVE-2026-77889 is a type confusion vulnerability (CWE-843) in the Windows DHCP Server component of Microsoft Windows 10 Version 1607 and other affected versions. The flaw allows an attacker without privileges or user interaction to cause a denial of service by accessing a resource using an incompatible type. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix for this vulnerability.

Successful exploitation of this vulnerability results in denial of service (DoS) over the network, impacting availability of the DHCP Server service on affected Windows systems. There is no confidentiality or integrity impact reported. No known exploits are currently in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77889. No additional mitigation actions are required beyond applying the official patch.