CVE-2026-56099
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
Risk Assessment
The risk involves leakage of sensitive kernel memory data, which could allow an attacker to gain information about the system or other processes, potentially leading to further privilege escalation.
Recommendation
It is recommended to immediately update OpenBSD to a version containing commit 6a23123 or later to eliminate the out-of-bounds read vulnerability.
Other vulnerabilities in OpenBSD
See all- CVE-2017-1000372Critical
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.
- CVE-2026-57589High
In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().
- CVE-2026-55706Medium
In OpenBSD before commit 076e2b1, the sppp_pap_input function in sys/net/if_spppsubr.c allows authentication bypass via certain zero values for lengths.
- CVE-2023-40216Medium
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
- CVE-1999-0481Medium
CVE-1999-0481 vulnerability concerns the 'poll' service in OpenBSD, which can lead to a denial of service.
- CVE-1999-0485Low
Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
- CVE-1999-0062High
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Original NVD description (English source)
OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.