CVE-2026-96934: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

CVE-2026-96934 is a use-after-free vulnerability (CWE-416) in the Windows DHCP Server that enables remote code execution by an unauthenticated attacker over the network. The vulnerability affects several Windows versions including Windows 10 Version 1607 and others, specifically versions >=10.0.14393.0 and <10.0.14393.9612, >=10.0.17763.0 and <10.0.17763.9376, >=6.2.9200.0 and <6.2.9200.26434, >=6.3.9600.0 and <6.3.9600.23470, >=10.0.20348.0 and <10.0.20348.5761, and >=10.0.26100.0 and <10.0.26100.33650. The vulnerability has been officially fixed by Microsoft, and detailed remediation guidance is available in the Microsoft Security Response Center advisory.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on affected systems, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. The vulnerability is exploitable over the network without user interaction, making it highly critical.

Microsoft has released official patches that address this vulnerability. It is strongly recommended to apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96934). No additional mitigations are specified beyond applying the official fix.