Analysis of a 1day (CVE-2019-0547) and discovery of a forgotten condition in the patch (CVE-2019-0726) – Part 1 of 2

This write-up analyzes a Windows DHCP client parsing bug: patch diffing of dhcpcore.dll reveals a zero-length HeapAlloc issue in handling DHCP Option 119 (Domain Search Option), leading to a memory corruption vulnerability. The author documents PoCs, describes how the original patch was bypassed to cause denial-of-service, and reported the issue as CVE-2019-0726; no reliable remote code execution is shown.