CVE-2026-77502

HighCVSS 7.5/10Last modified Sep 24, 2026

Description

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.26349
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.26349
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.23398
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.23398
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5622
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33438
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33438

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77502Patch, Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-775037.8Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.CVE-2026-775048.8Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-775058.1Use after free in DNS Server allows an unauthorized attacker to execute code over a network.CVE-2026-775064.8Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.CVE-2026-775075.3Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-CVE-2026-775083.5Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH CVE-2026-775165.4MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a too CVE-2026-775175.4MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize CVE-2026-775185.0MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP CVE-2026-775195.4MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an Applicatio CVE-2026-775205.4MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user'CVE-2026-7752110.0MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-applicatio