CVE-2026-71401
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In wicked up to version 0.6.80, an integer underflow exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() does not verify that the IP total length field is at least as large as the IP header length before subtracting. An unauthenticated attacker on the same network can trigger an out-of-bounds read, potentially crashing the daemon.
Risk Assessment
An attacker could cause a denial of service of the DHCPv4 client, potentially disrupting network services that rely on IP address assignment.
Recommendation
Update wicked to a version newer than 0.6.80 or restrict trust in DHCP traffic on the network.
Original NVD description (English source)
An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the header length. An unauthenticated attacker on the same network can thereby trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client (wickedd-dhcp4), which can crash the daemon depending on the process memory layout. No information disclosure has been demonstrated. This issue affects wicked up to and including version 0.6.80.