Release of invalid pointer or reference in Windows Server - CVE-2026-105560
Published: November 10, 2026
Vulnerability identifier: #VU164680
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105560
CWE-ID: CWE-763
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary code on the affected server.
The vulnerability exists due to release of an invalid pointer or reference in Windows DHCP Server when processing network input. A remote privileged user can supply specially crafted network input to trigger the memory management error and execute arbitrary code.
Affected software
Windows Server
How to mitigate CVE-2026-105560
Install security update from vendor's website.
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822