CVE-2026-56116
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A memory leak vulnerability in dhcpcd through version 10.3.2, fixed in commit 708b4a5, exists in IPv6 Router Advertisement route information handling. An unauthenticated same-link attacker can cause denial of service by sending crafted Router Advertisements, leading to linear memory exhaustion and daemon crash.
Risk Assessment
An attacker can crash the DHCP service on the device, preventing clients from obtaining IP addresses and other network configurations, resulting in network disruptions.
Recommendation
Immediately update dhcpcd to a version containing the fix (commit 708b4a5) or later. If an update is not possible, restrict trust in Router Advertisement messages by filtering IPv6 traffic.
Other vulnerabilities in dhcpcd
See all- CVE-2016-1504High
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service via invalid reads, leading to crashes.
- CVE-2012-6700High
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.
- CVE-2012-6699High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.
- CVE-2012-6698High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.
- CVE-2016-1503Critical
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
- CVE-2026-14258Medium
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
- CVE-2026-56117Medium
A use-after-free vulnerability in dhcpcd through version 10.3.2, fixed in commit 78ea09e, exists in control socket handling in src/control.c. Local unprivileged attackers can trigger memory corruption when privilege separation is disabled by sending a privileged command (e.g., -x) to the control socket.
- CVE-2026-56114Medium
A vulnerability in dhcpcd up to version 10.3.2 (fixed in commit 2f00c7b) allows an unauthenticated same-link attacker to perform a one-byte stack out-of-bounds write by sending a crafted DHCPv6 ADVERTISE message with an OPTION_PD_EXCLUDE option using prefix lengths /121 to /128. The flaw resides in dhcp6_makemessage() in src/dhcp6.c and can corrupt adjacent stack memory.
- CVE-2026-56113Medium
In dhcpcd up to version 10.3.2, a heap use-after-free vulnerability allows an unauthenticated same-link attacker to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
Original NVD description (English source)
dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.