ConnMan CVE-2026-115863

The attacker must be on-link (adjacent network segment) with the victim host. The host must run ConnMan (through 2.0) with DHCPv6 active and must accept a forged Router Advertisement with the Other-config flag set (O=1), which drives ConnMan into a DHCPv6 information-request exchange. The attacker then needs a forged DHCPv6 REPLY whose transaction ID (xid) and CLIENTID match the victim's in-flight exchange and that carries a DOMAIN_LIST option (option 24) of ≥1025 non-zero bytes. Limiting factors: exploitation cannot be performed remotely across routed networks (AV:A), and the REPLY must match the victim's xid/CLIENTID, though an on-link attacker can observe or race these; no authentication or user interaction is required.

The signals point to a moderate, situational denial-of-service risk rather than a top-tier emergency. The CVSS vector is AV:A (adjacent/on-link), not AV:N, so exploitation is confined to an attacker already on the same link - this materially shrinks the attack surface versus an internet-facing flaw of the same 7.6 score. AC:L/PR:N/UI:N confirm that, once on-link, no authentication, user interaction or unusual effort is needed, and the described impact is a crash of connmand running as root (A:H), consistent with the vendor-supplied C:L/I:L/A:H though the only outcome the description actually establishes is a crash. The vuln.today Decision label is this_week (not act_now/emergency), aligning with a serious-but-not-critical posture. EPSS score is NOT provided in the input, and there is no SSVC decision breakdown (exploitation/automatable/technical-impact) supplied, so probability-of-exploitation and automatability cannot be assessed from this data. KEV status is absent, so there is no evidence of active exploitation. The references are a disclosure mailing-list post, the vulnerable source file, and the commit that INTRODUCED the bug - none is exploit code. Note the tension between the out-of-bounds read/write primitive described (writing '.' past the buffer in attacker-chosen strides) and the stated impact of a mere crash: a write primitive could in principle be worse than DoS, but the sources only confirm a crash, so RCE should NOT be assumed.

An attacker on the same local link (e.g. a shared Wi-Fi or Ethernet segment) forges a Router Advertisement with the Other-config flag set to push the victim's ConnMan into a DHCPv6 information exchange, then sends a forged DHCPv6 REPLY matching the victim's transaction ID and CLIENTID carrying a DOMAIN_LIST (option 24) of 1025 or more non-zero bytes. The oversized option overruns the 1026-byte dns_name stack buffer in get_domains(), crashing connmand, which runs as root, and dropping the host's network management. No public exploit code is identified in the provided references, and exploitation requires adjacent-network position (AV:A).