CVE-2026-55995

An issue was discovered in Open-iSCSI through 2.0.875 that allows a local attacker to cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths. The lack of payload length validation in the process_iscsid_broadcast function leads to buffer overflows.

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 DHCP parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing.

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short UDP length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted ICMPv6 Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

open-iscsi has an Incorrect Authorization vulnerability that allows unprivileged local users to use the iscsiuio control socket. The issue affects versions up to 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

A Path Traversal vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.