CVE-2026-56114
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in dhcpcd up to version 10.3.2 (fixed in commit 2f00c7b) allows an unauthenticated same-link attacker to perform a one-byte stack out-of-bounds write by sending a crafted DHCPv6 ADVERTISE message with an OPTION_PD_EXCLUDE option using prefix lengths /121 to /128. The flaw resides in dhcp6_makemessage() in src/dhcp6.c and can corrupt adjacent stack memory.
Risk Assessment
An attacker could crash the dhcpcd service or potentially achieve arbitrary code execution, compromising system stability and security.
Recommendation
Upgrade dhcpcd to a version containing commit 2f00c7b or later. If an upgrade is not possible, restrict trusted DHCPv6 message sources on the local network.
Other vulnerabilities in dhcpcd
See all- CVE-2016-1504High
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service via invalid reads, leading to crashes.
- CVE-2012-6700High
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.
- CVE-2012-6699High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.
- CVE-2012-6698High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.
- CVE-2016-1503Critical
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
- CVE-2026-14258Medium
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
- CVE-2026-56117Medium
A use-after-free vulnerability in dhcpcd through version 10.3.2, fixed in commit 78ea09e, exists in control socket handling in src/control.c. Local unprivileged attackers can trigger memory corruption when privilege separation is disabled by sending a privileged command (e.g., -x) to the control socket.
- CVE-2026-56116Medium
A memory leak vulnerability in dhcpcd through version 10.3.2, fixed in commit 708b4a5, exists in IPv6 Router Advertisement route information handling. An unauthenticated same-link attacker can cause denial of service by sending crafted Router Advertisements, leading to linear memory exhaustion and daemon crash.
- CVE-2026-56113Medium
In dhcpcd up to version 10.3.2, a heap use-after-free vulnerability allows an unauthenticated same-link attacker to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
Original NVD description (English source)
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.