CVE-2026-56114

Name
CVE-2026-56114
Description
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/NetworkConfiguration/dhcpcd/commit/2f00c7bfc408b6582d331932dfa47829c4819029
disclosure@vulncheck.com https://www.vulncheck.com/advisories/dhcpcd-stack-out-of-bounds-write-in-dhcp6-makemessage

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:* dhcpcd >= None <= 10.3.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
dhcpcd edge-main 10.3.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.1.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.1.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.24-main 10.3.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.23-main 10.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.22-main 10.2.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.21-main 10.1.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.21-main 10.1.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.20-main 10.0.6-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.20-main 10.0.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.19-main 10.0.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable