CVE-2026-56117
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A use-after-free vulnerability in dhcpcd through version 10.3.2, fixed in commit 78ea09e, exists in control socket handling in src/control.c. Local unprivileged attackers can trigger memory corruption when privilege separation is disabled by sending a privileged command (e.g., -x) to the control socket.
Risk Assessment
The risk involves potential local privilege escalation or system compromise by an unprivileged user in environments where dhcpcd runs with privilege separation disabled (--disable-privsep) or where privsep initialization failed and the control socket operates in mode 0666.
Recommendation
Immediately update dhcpcd to a version containing commit 78ea09e or later. If an update is not possible, enable privilege separation (privsep) and ensure the control socket is not in mode 0666.
Other vulnerabilities in dhcpcd
See all- CVE-2016-1504High
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service via invalid reads, leading to crashes.
- CVE-2012-6700High
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.
- CVE-2012-6699High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.
- CVE-2012-6698High
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.
- CVE-2016-1503Critical
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
- CVE-2026-14258Medium
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
- CVE-2026-56116Medium
A memory leak vulnerability in dhcpcd through version 10.3.2, fixed in commit 708b4a5, exists in IPv6 Router Advertisement route information handling. An unauthenticated same-link attacker can cause denial of service by sending crafted Router Advertisements, leading to linear memory exhaustion and daemon crash.
- CVE-2026-56114Medium
A vulnerability in dhcpcd up to version 10.3.2 (fixed in commit 2f00c7b) allows an unauthenticated same-link attacker to perform a one-byte stack out-of-bounds write by sending a crafted DHCPv6 ADVERTISE message with an OPTION_PD_EXCLUDE option using prefix lengths /121 to /128. The flaw resides in dhcp6_makemessage() in src/dhcp6.c and can corrupt adjacent stack memory.
- CVE-2026-56113Medium
In dhcpcd up to version 10.3.2, a heap use-after-free vulnerability allows an unauthenticated same-link attacker to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
Original NVD description (English source)
dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.