CVE-2026-62716 is an integer underflow in Windows DHCP Server that produces an out-of-bounds read from DHCP state tracking structures. The CVSS 6.5 and EPSS 0.00478 signal moderate severity with no current active exploitation — but the real risk profile depends entirely on what that underflow exposes from DHCP server memory.
The adjacent-network requirement is being treated as a mitigator, and that's a mistake for this specific service. DHCP operates at the Layer 2/Layer 3 boundary with an implicit trust model built for 1995 networks. In multi-tenant colocation, campus infrastructure, and poorly segmented hospitality networks, 'adjacent' means an attacker sitting inside the same broadcast domain where DHCP lives — which is already a partial trust compromise. The question isn't whether remote attackers can reach it; it's whether anyone on any network segment adjacent to your DHCP infrastructure has been elevated to 'insider' status in your threat model.
Here's what makes this worse: DHCP lease data is a correlation hub, not just a data leak. The information disclosed — client identifiers, lease times, IP assignments — is exactly what maps every device on that segment without scanning. MAC-to-IP mappings de-anonymize clients. Lease fingerprints identify device types. In Windows AD environments, this has been the first move in documented attack chains: pull DHCP state, build the target inventory, pivot. The CVSS scores this as medium-severity information disclosure; the actual operational impact is strategic reconnaissance for lateral movement.
The fact that this is an information disclosure rather than a crash is itself significant. Integer underflows typically cause crashes; an out-of-bounds read that doesn't fault suggests the underflow lands in a region that's partially initialized or maps to valid process memory. That means the flaw may have existed silently in some configurations without triggering visibly — crash bugs get noticed, silent reads get buried.
Prioritize patching DHCP servers in shared infrastructure environments first. Verify your network segmentation actually isolates DHCP to its intended broadcast domain — not just logically, but at Layer 2. If you can't confirm that segmentation, treat any adjacent segment compromise as a DHCP compromise. Monitor for unexpected DHCP packet capture activity on segments with multi-tenant or contractor access; an attacker who knows this CVE exists has a precise pattern to look for. The low EPSS is not reassurance — it means this is sitting unpatched in exactly the environments where it would do maximum damage, waiting for a reliable trigger to surface.