Exposure of Sensitive System Information to an Unauthorized Control Sphere in Windows Server - CVE-2026-105557
Published: November 10, 2026
Vulnerability identifier: #VU164677
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105557
CWE-ID: CWE-497
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose limited sensitive information from memory in a privileged process.
The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server when handling network requests. A remote attacker can observe comparison results to infer limited information from the privileged process's memory, rather than obtaining unrestricted read access.
Successful exploitation relies on complex memory shaping techniques.
Affected software
Windows Server
How to mitigate CVE-2026-105557
Install security update from vendor's website.
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822