CVE-2026-88243

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-882447.5Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-882457.8Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-882475.5Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information localCVE-2026-882498.8Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network.CVE-2026-88254.9The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through oneCVE-2026-882525.5A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors CVE-2026-882556.3Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submisCVE-2026-882575.3Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch functionCVE-2026-882597.5CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with CVE-2026-882608.7Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in BrainzcoCVE-2026-882615.1Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1.CVE-2026-882628.7Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1.
CVE-2026-88243: Critical severity, CVSS 9.8 | Vulnix