Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-56114

dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NetworkConfiguration dhcpcd

Default version status: affected

  • 0 to ≤ 10.3.2affected
  • 2f00c7bfc408b6582d331932dfa47829c4819029unaffected
pkg:github/NetworkConfiguration/dhcpcd

References