The CVSS 7 score on this DHCP Client use-after-free deserves scrutiny. A SYSTEM-privileged service achieving code execution typically scores 8-9; a 7 suggests either exploitation difficulty or a scoring convention that hasn't kept pace with this specific attack surface.
The 'authorized attacker' qualifier is doing more work than it appears. Microsoft's phrasing consistently maps to network adjacency sufficient for DHCP injection — not local credentials, not authenticated access. An attacker on the same broadcast domain can send malformed DHCP responses to the client. That changes the blast radius from 'one workstation' to 'every Windows host on the subnet simultaneously,' because DHCP responses are broadcast or unicast to the client, and Windows renews leases hourly by default. That's not a one-time window — it's an hourly refresh of the exploitation surface across the entire network segment.
The CVSS 7 likely reflects Microsoft's internal knowledge of their own mitigations. HVCI and CFG raise the exploitation bar significantly for this class of bug, but the historical record is telling: DHCP Client UAFs have produced a consistent lineage of CVEs over the past decade, all clustering in the 6.5-7.5 range despite evidence of SYSTEM-level code execution. That's pattern drift — a scoring convention that became self-reinforcing rather than evidence-based. The mitigations make reliable exploitation harder, but they don't eliminate the class, and the gap between the privilege level achieved and the score assigned reflects optimistic assumption as much as genuine constraint.
Defenders should treat this as a network-adjacent privilege escalation with broadcast-domain reach. The fix isn't just patching — it's understanding that this service runs from boot to shutdown, accumulating state across hours of lease renewals. Exploitation doesn't require a perfect single-packet payload; it requires understanding the object's lifecycle through multiple renewal cycles. Network segmentation limits the injection path, but the temporal dimension of the attack surface means the exposure persists as long as the client is running.
What to check: ensure DHCP Client is firewalled from untrusted network segments, verify HVCI is enabled on affected hosts, and treat this service as a high-value target for lateral movement even within supposedly trusted network zones.