Remote Code Execution in Windows DHCP Client Service

Successful exploitation can result in remote code execution in the context of the affected Windows DHCP Client Service, allowing an attacker to execute arbitrary code on the target system. Because the vulnerable component is a core Windows networking service, compromise could enable follow-on actions such as installing malware, altering system state, accessing data available to the compromised context, and using the host as a foothold for further intrusion.

Where immediate patching is not possible, reduce exposure by limiting attacker ability to obtain machine-in-the-middle position on local network segments. Use network segmentation, restrict access to trusted Layer 2 environments, enforce protections against rogue network infrastructure, and minimize use of untrusted shared networks. Monitoring for anomalous DHCP behavior and suspicious local network interception activity may help detect exploitation attempts, but no complete mitigation short of vendor remediation is currently available from the provided information.

Apply Microsoft's February 2025 security updates for supported Windows systems and Windows Server platforms that address CVE-2025-21379. Prioritize patching endpoints and servers exposed to untrusted or shared local network segments, as the vulnerability affects the Windows DHCP Client component across Windows builds referenced in the available reporting.