OnlyPatch
Windows DHCP Server

CVE-2023-28231 — DHCP Server Service Remote Code Execution Vulnerability

Critical CVSS 8.8 EPSS 0.36874 🔬 Patch diffed 2023-04 archive

Executive Summary

None

Overview

8.8
CVSS HIGH
Critical
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-122: Heap-based Buffer Overflow
Released Apr 11 2023
Last Updated Apr 11 2023
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.36874 — 0.98375 percentile
NVD CVSS 8.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Adjacent_network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.7

EPSS Score

0.36874
probability of exploitation in the next 30 days
0.98375 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

6 affected products
Product KB Article Severity Impact Restart Required
Windows Server 2008 for 32-bit Systems Service Pack 2 5025271 (Monthly Rollup) 5025273 (Security Only) Critical Remote Code Execution 5023755 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5025271 (Monthly Rollup) 5025273 (Security Only) Critical Remote Code Execution 5023755 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for x64-based Systems Service Pack 2 5025271 (Monthly Rollup) 5025273 (Security Only) Critical Remote Code Execution 5023755 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5025271 (Monthly Rollup) 5025273 (Security Only) Critical Remote Code Execution 5023755 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 R2 for x64-based Systems Service Pack 1 5025279 (Monthly Rollup) 5025277 (Security Only) Critical Remote Code Execution 5023769 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.26466 Yes 5025279 5025277 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5025279 (Monthly Rollup) 5025277 (Security Only) Critical Remote Code Execution 5023769 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.26466 Yes 5025279 5025277 Windows Server 2012 5025287 (Monthly Rollup) 5025272 (Security Only) Critical Remote Code Execution 5023769 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.2.9200.24216 Yes None Windows Server 2012 (Server Core installation) 5025287 (Monthly Rollup) 5025272 (Security Only) Critical Remote Code Execution 5023769 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.2.9200.24216 Yes None Windows Server 2012 R2 5025285 (Monthly Rollup) 5025288 (Security Only) Critical Remote Code Execution 5023765 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.3.9600.20919 Yes None Windows Server 2012 R2 (Server Core installation) 5025285 (Monthly Rollup) 5025288 (Security Only) Critical Remote Code Execution 5023765 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.3.9600.20919 Yes None Windows Server 2016 5025228 (Security Update) Critical Remote Code Execution Yes
Windows Server 2016 (Server Core installation) 5025228 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 5025229 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 (Server Core installation) 5025229 (Security Update) Critical Remote Code Execution Yes
Windows Server 2022 5025230 (Security Update) Critical Remote Code Execution Yes
Windows Server 2022 (Server Core installation) 5025230 (Security Update) Critical Remote Code Execution Yes

Patches

3 patches
Article Type Restart
5025228 Security Update Yes
5025229 Security Update Yes
5025230 Security Update Yes

Patch Diff

ghidriff · dhcpssvc.dll (KB5025229)

Network-adjacent, pre-auth heap overflow (CWE-122) in the Windows DHCPv6 Server service (dhcpssvc.dll, NETWORK SERVICE) on UDP/547. ProcessRelayForwardMessage allocates a fixed 1664-byte on-object array (32 entries x 0x34 bytes; memset at obj+0x644, size 0x680) plus a nested-hop counter at obj+0xcc4. For each nested DHCPv6 Relay-forward message (msg-type 12, Relay Message option-code 9) it writes an entry at counter*0x34 + base and increments the counter, WITHOUT ever checking the counter against the 32-entry max. A Relay-forward packet with more than 32 nested Relay-forward messages drives counter*0x34 past the 1664-byte array, corrupting adjacent heap with attacker-controlled bytes -> RCE (escalatable from NETWORK SERVICE to SYSTEM). IN-HOUSE ghidriff diff of 10.0.17763.3469 -> .4252 confirms ProcessRelayForwardMessage is the ONLY function changed (99% match) and adds the missing guard: uVar6 = counter@+0xcc4; if (0x1f < uVar6) return 0x4e2f (reject when counter >= 32) before the write. NOTE: the fix is UNCONDITIONAL - no CFR/KIR flag - unlike the 2025-2026 fixes in this corpus. Credit: YanZiShuang@BigCJTeam of cyberkl; public analysis Guy Lederfein & Lucas Miller (Trend Micro/ZDI).

Pre-patch version 10.0.17763.3469 Download
Post-patch version 10.0.17763.4252 Download
Function Address Change Note
ProcessRelayForwardMessage 99% match (only changed function) code (bounds check added, unconditional) Pre: nested-hop counter at obj+0xcc4 used unbounded to index counter*0x34 into a fixed 32-slot (0x680-byte) array at obj+0x644. Post: reads counter into uVar6 and adds `if (0x1f < uVar6) return 0x4e2f;` (reject when counter >= 32) before any slot write. No feature flag - always-on fix; patch state determined by file version.
View full diff report View RCA report

Attack Path

More than 32 nested DHCPv6 Relay-forward messages overrun a fixed 32-slot hop array in the DHCP service

Attack path for CVE-2023-28231 More than 32 nested DHCPv6 Relay-forward messages overrun a fixed 32-slot hop array in the DHCP service 01 — ENTRY Network-adjacent attacker sends a DHCPv6 Relay-forward to UDP/547 dhcpssvc.dll (DHCP Server service, NETWORK SERVICE) parses inbound DHCPv6 off the wire with no authentication. DHCP is link-scoped, so the attacker must be network-adjacent. 02 — CONTROLLED INPUT The packet nests >32 Relay-forward messages via chained Relay Message options Each Relay-forward (msg-type 12) carries a Relay Message option (option-code 9) whose data is another relayed message; relay agents legitimately nest, so a chain of nested Relay-forward messages is well-formed input. 03 — PATH ProcessRelayForwardMessage records each hop in a fixed 32-entry array and bumps a counter memset(obj+0x644, 0, 0x680) sets up 32 entries of 0x34 bytes; the hop counter at obj+0xcc4 indexes entry writes at counter*0x34 + base. 04 — MISSING CHECK The hop counter is never checked against the 32-entry maximum Nothing asserts counter < 32 before writing entry[counter]. The 33rd nested Relay-forward makes counter*0x34 point past the 1664-byte array. 05 — PRIMITIVE Controlled heap overflow in the NETWORK SERVICE DHCP process -> RCE Per-slot writes past the array corrupt adjacent heap with attacker-controlled nested-message fields; code execution as NETWORK SERVICE (escalatable to SYSTEM), or service crash. The April 2023 patch adds `if (counter >= 32) return 0x4e2f;` - an unconditional bounds check (no feature flag).

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

YanZiShuang@BigCJTeam of cyberkl

On This Page