Loading vulnerability…
Remote Code Execution in Windows DHCP Client Service
CVE-2025-21379 is a remote code execution vulnerability in the Windows DHCP Client Service. The flaw is described as a use-after-free condition in the DHCP Client component. An attacker positioned on the same network segment can exploit the memory corruption issue by conducting a machine-in-the-middle attack against DHCP traffic, potentially causing the service to access previously freed memory in a way that enables arbitrary code execution. Available reporting indicates exploitation is considered difficult and requires precise network positioning and timing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution in the context of the affected Windows DHCP Client Service, allowing an attacker to execute arbitrary code on the target system. Because the vulnerable component is a core Windows networking service, compromise could enable follow-on actions such as installing malware, altering system state, accessing data available to the compromised context, and using the host as a foothold for further intrusion.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, reduce exposure by limiting attacker ability to obtain machine-in-the-middle position on local network segments. Use network segmentation, restrict access to trusted Layer 2 environments, enforce protections against rogue network infrastructure, and minimize use of untrusted shared networks. Monitoring for anomalous DHCP behavior and suspicious local network interception activity may help detect exploitation attempts, but no complete mitigation short of vendor remediation is currently available from the provided information.
Patch, then assume compromise.
Apply Microsoft's February 2025 security updates for supported Windows systems and Windows Server platforms that address CVE-2025-21379. Prioritize patching endpoints and servers exposed to untrusted or shared local network segments, as the vulnerability affects the Windows DHCP Client component across Windows builds referenced in the available reporting.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.