CVE-2019-0626

CVE-2019-0626 is a critical memory corruption vulnerability affecting the Windows Server DHCP service across numerous Windows versions, including Windows 10, Windows Server 2008-2019. This vulnerability, with a CVSS score of 9.8, allows for remote code execution when an unauthenticated attacker sends specially crafted packets to a vulnerable DHCP server. The attack requires no user interaction and has a high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, its EPSS score and FAUCET Risk Score indicate a significant likelihood of exploitation. There is no public exploit code available (Metasploit, Nuclei, ExploitDB), but the vulnerability has garnered notable community discussion and media coverage, suggesting awareness among security researchers.