CVE-2026-18725

Medium

Published: —Translated: 18/08/2026(UTC)NVD NIST

Summary

Vulnerability in the iscsi-initiator-utils package involves out-of-bounds write and information disclosure via unvalidated IPv6 payload length. Crafted ICMPv6 Echo requests can cause the iscsiuio daemon to trust an inflated ipv6_plen larger than the actual received payload.

Risk Assessment

An attacker could exploit this to write out of bounds, potentially causing service crash or arbitrary code execution, and to disclose sensitive information.

Recommendation

Immediately update the iscsi-initiator-utils package to a patched version and monitor vendor security advisories.

Other vulnerabilities in iscsi-initiator-utils

CVE-2026-18724Medium
The iscsi-initiator-utils package version 6.2.1.11-0.git4b3e853.el10 has a stack buffer overflow vulnerability in idbm_recinfo_config. A malicious iSCSI target can inject an extra configuration line into a persisted node record via a crafted SendTargets TargetName, later causing a stack buffer overflow.

Original NVD description (English source)

AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to trust an inflated `ipv6_plen` larger than the actual received payload,