open-iscsi iscsiuio CVE-2026-115485

The vulnerable iscsiuio daemon (open-iscsi) must be running and processing DHCPv6, which in practice means an iSCSI offload/boot deployment configured to obtain parameters over DHCPv6 - it is not a default-active service on most hosts. The attacker must be on the same network segment (AV:A) to deliver the crafted DHCPv6 Advertise message, typically by acting as a rogue or racing DHCPv6 responder; no authentication (PR:N) or user interaction (UI:N) is required. Limiting factors that reduce realistic exposure: adjacency requirement means it is not remotely exploitable across the Internet, and systems not running iscsiuio or not using DHCPv6 for iSCSI are unaffected.

This is a medium-severity issue (CVSS 6.3) whose signals are internally consistent but point to a bounded, non-urgent priority. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L shows an adjacent-network (not Internet-facing), low-complexity, unauthenticated flaw with partial confidentiality, integrity and availability impact - matching an out-of-bounds read (CWE-125) that can leak heap memory, cause a 1-byte heap overwrite, or crash the daemon. The vuln.today decision label is 'this_month', which aligns with the moderate severity and argues against treating this as an emergency. EPSS is not provided, so exploitation probability cannot be quantified; it is NOT in CISA KEV, and the two references (Red Hat access portal and Red Hat Bugzilla) are vendor advisory/tracking links, not exploit code - so there is no public exploit identified at time of analysis. The main factors that lower real-world risk are the AV:A constraint (attacker must be on the same L2 segment) and the requirement that the iscsiuio daemon actually be running and using DHCPv6, which is a specific iSCSI offload/boot configuration rather than a default state. Net: a legitimate but non-critical patch-this-month item, not a high-CVSS-but-illusory issue nor a drop-everything emergency.

An attacker positioned on the same local network segment (for example via a rogue or spoofing DHCPv6 responder) sends a crafted DHCPv6 Advertise message whose option data lacks a NUL terminator. When iscsiuio's DHCPv6 option parser calls strlen() on that raw network data it reads past the buffer into heap memory, which can crash the daemon (denial of service), leak adjacent heap contents, or produce a 1-byte heap overwrite or corruption of the iSCSI initiator name. No public exploit code has been identified at time of analysis.