CVE-2026-54128

This flaw is like a “memory mistake” in Windows’ DHCP Client, which is responsible for getting network settings (like an IP address). An attacker who can reach the machine in the local sense can trick Windows into using freed memory, which can let them run their own code. For a business, that’s the difference between a normal computer and one an attacker can fully control.

This affects Windows 10, Windows 11, and multiple Windows Server versions (2012, 2012 R2, 2016, 2019, 2022, 2025) that include the Windows DHCP Client component. It matters to you if your business uses these operating systems on devices that other people or systems can access locally (for example, network-segmented environments, shared admin access paths, or devices that are reachable by attackers on the same infrastructure). The risk is especially relevant when an attacker can get a foothold that makes “local exploitation” possible, since authentication and user interaction are not required by the vulnerability.

This is RED because attackers can execute arbitrary code on the target machine using the DHCP client’s privileges, which can quickly lead to full compromise. Even though a public exploit isn’t confirmed in the findings, the fix is available and the impact is high, so waiting increases your exposure window.