CVE-2026-56113
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In dhcpcd up to version 10.3.2, a heap use-after-free vulnerability allows an unauthenticated same-link attacker to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
Risk Assessment
The risk is that an attacker on the same link can remotely crash the DHCP service, potentially disrupting DHCP clients and causing network connectivity loss in the organization.
Recommendation
Immediately update dhcpcd to a version containing commit 5733d3c or later, which fixes this vulnerability.
Other vulnerabilities in dhcpcd
See all- CVE-2016-1504High
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service via invalid reads, leading to crashes.
- CVE-2012-6700High
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.
- CVE-2012-6699High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.
- CVE-2012-6698High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.
- CVE-2016-1503Critical
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
- CVE-2026-14258Medium
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
- CVE-2026-56117Medium
A use-after-free vulnerability in dhcpcd through version 10.3.2, fixed in commit 78ea09e, exists in control socket handling in src/control.c. Local unprivileged attackers can trigger memory corruption when privilege separation is disabled by sending a privileged command (e.g., -x) to the control socket.
- CVE-2026-56116Medium
A memory leak vulnerability in dhcpcd through version 10.3.2, fixed in commit 708b4a5, exists in IPv6 Router Advertisement route information handling. An unauthenticated same-link attacker can cause denial of service by sending crafted Router Advertisements, leading to linear memory exhaustion and daemon crash.
- CVE-2026-56114Medium
A vulnerability in dhcpcd up to version 10.3.2 (fixed in commit 2f00c7b) allows an unauthenticated same-link attacker to perform a one-byte stack out-of-bounds write by sending a crafted DHCPv6 ADVERTISE message with an OPTION_PD_EXCLUDE option using prefix lengths /121 to /128. The flaw resides in dhcp6_makemessage() in src/dhcp6.c and can corrupt adjacent stack memory.
Original NVD description (English source)
dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.