The CVSS 8.8 rating for this DHCP server heap overflow deserves scrutiny, and the EPSS score of 0.00555 is telling you something important: the probability of in-the-wild exploitation within 30 days is extremely low, far below what that CVSS number would predict. The gap isn't noise — it's a signal about where the real barrier lies.
The key is the "adjacent network" attack vector. This isn't a remote-from-internet vulnerability. The attacker needs layer 2 adjacency — they must be on the same broadcast domain, behind the same switch fabric, or capable of layer 2 attacks like VLAN hopping or ARP spoofing to reach the DHCP server. You cannot exploit this from a coffee shop WiFi or through NAT. The realistic attacker must already be positioned on your corporate LAN or have bypassed your network segmentation controls. This fundamentally changes the threat model from an external opportunistic attacker to a malicious insider, a compromised device already on the internal network, or someone who used a separate vulnerability to achieve L2 adjacency.
Here is what matters practically: first, understand your DHCP server footprint. DHCP servers are often provisioned during initial deployments, acquisitions, or lab work and then quietly forgotten. Organizations with mature internet-facing patch programs frequently have zero visibility into forgotten DHCP infrastructure — the same adjacency constraint that makes this CVE harder to exploit also creates organizational opacity. You cannot patch what you don't know exists. Audit your network for active DHCP servers you may have lost track of, particularly in acquired networks, lab environments, or shadow IT deployments.
Second, recognize that DHCP itself has no built-in authentication by design — it's a protocol that expects unauthenticated input at layer 2. This means malformed DHCP traffic is the expected environment, not an anomaly. Your monitoring should treat DHCP traffic as a trust boundary worth inspecting, even though the protocol doesn't enforce trust. Anomalous DHCP behavior — unexpected servers, unusual option configurations, traffic from unexpected sources — is a legitimate detection opportunity.
Third, the EPSS number reflects current researcher attention, not absolute exploitability. If your organization has forgotten DHCP servers sitting unpatched in a network segment accessible to compromised IoT devices, malicious insiders, or switch firmware vulnerabilities, the adjacency prerequisite for this CVE is already satisfied. The exploitation probability for your specific environment may be orders of magnitude higher than the EPSS baseline suggests. The vulnerability's urgency in your environment is determined by whether the prerequisite adjacency is already present in your forgotten infrastructure layer — and that is a question your asset inventory should answer.
Patch this vulnerability, but treat it as important infrastructure maintenance rather than an emergency. The emergency response culture that treats every CVSS 8.8 as critical trains operations teams to ignore security advisories — which degrades response to genuinely critical patches. Prioritize based on whether you have forgotten DHCP servers that are reachable from network segments with uncontrolled devices, and make that inventory your real priority.