The CVSS 6.5 rating on CVE-2026-62814 obscures what actually matters: this integer underflow in Windows DHCP parsing doesn't need a sophisticated attacker to exploit—it needs someone on the adjacent network, which for DHCP means anyone who can send packets to the server's subnet. DHCP is fundamentally a broadcast protocol that accepts unsolicited responses from any machine on the wire. An attacker doesn't need a prior foothold to reach a DHCP server's subnet; they need a network interface and the ability to send DHCPINFORM or DHCPACK responses. Compromised switches, VLAN hopping, or a rogue Wi-Fi association satisfy this trivially. The adjacent-network constraint is a checklist item, not a meaningful barrier.
What makes this notable is what the underflow discloses. The vulnerability sits in how the DHCP server handles variable-length options in client requests—specifically in parsing paths like vendor-class-identifier or relay-agent-information that have historically received minimal fuzzing precisely because they're considered rarely reached in normal operation. This is not an isolated mistake. Microsoft has patched DHCP remote code execution and information disclosure bugs in this same stack in 2011, 2014, 2017, and 2020—each time the same pattern of length or offset arithmetic wrapping in option parsing. The pattern persists because DHCP is forgotten infrastructure: solved, stable, and architecturally untouched because refactoring working protocol parsing carries invisible risk and zero visible reward. The integer underflow is a symptom of accumulated complexity, not a one-off error.
The information disclosed is not reconnaissance noise. DHCP lease tables reveal IP assignments, device type fingerprints from vendor OUIs, lease timing patterns that expose shift schedules or operational windows, and hostnames that expose asset naming conventions. That's not a static map—it's a real-time feed. An attacker exploiting this can observe when new devices join the network, when others stop renewing (retirements, compromised hosts pulled offline), and calibrate spoofed DHCP responses to blend with observed network behavior. The lease table compresses the attack surface enough that an attacker doesn't need to ping-sweep or port-scan their way to interesting targets—they've already been handed the topology.
For defenders, the priority isn't the CVSS score—it's what this disclosure signals about the DHCP trust model. Review where your DHCP servers sit relative to untrusted network segments. Implement DHCP snooping on switches to block rogue responses. Treat DHCP server placement as a segmentation boundary, not infrastructure plumbing. The medium-severity rating will drive the slowest remediation cycles because it doesn't trigger the urgency of criticals. That's the actual exploitability window: between disclosure and patch deployment, attackers have a known code-path pattern from fifteen years of similar fixes to guide exploitation development. The vulnerability is in the queue; the exposure window stays open.