ISC DHCP Server CVE-2026-18103

Exploitation requires TCP-level network access to the OMAPI management port (default 7911) on the target DHCP server - this is a management interface separate from the standard DHCP client ports (UDP 67/68) and is not normally exposed to end-user network segments. The decisive condition governing authentication is whether TSIG key authentication has been configured on the OMAPI interface: without TSIG (common in many deployments), the port accepts unauthenticated connections and exploitation requires only network reachability with no credentials. With TSIG configured (the CVSS PR:H scenario), an attacker must possess a valid TSIG secret, substantially limiting exploitation to insiders or credential-compromised hosts. The malformed lease request must specify an InfiniBand (IPoIB) hardware type MAC address to reach the vulnerable code path in print_hw_addr(); standard Ethernet MAC addresses do not trigger the overflow. No user interaction on the target system is required, and the attack is single-packet, non-interactive, and trivially repeatable to maintain the DoS condition across restart attempts.

The official CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H yields a base score of 4.9 (Medium), but the PR:H assignment is contingent on TSIG being configured - a non-default state. The description's phrasing 'especially if not secured with TSIG' indicates that in the common unprotected deployment scenario, no authentication barrier exists and the effective privilege requirement is PR:N, pushing the realistic severity toward a CVSS 3.1 score of approximately 7.5 (High). The availability impact is amplified beyond a typical DoS because the crash is persistent: dhcpd cannot automatically restart and requires manual operator intervention, extending network outage duration in environments that depend on DHCP for IP assignment, network boot (PXE), or infrastructure automation. EPSS data was not provided in the available intelligence; KEV status is absent, meaning no confirmed active exploitation has been reported. No public proof-of-concept is referenced. Overall real-world risk is moderate for environments with TSIG deployed and OMAPI firewalled, and significantly elevated for those with open OMAPI ports and no TSIG.

An attacker with TCP access to the OMAPI port (7911) on an RHEL dhcp-server host where TSIG authentication is not configured constructs a lease creation message with an InfiniBand hardware address field that exceeds the expected length boundary. When dhcpd processes the request and invokes print_hw_addr(), the oversized address overflows the stack or heap buffer, corrupting process state and crashing dhcpd immediately. All DHCP clients on the network segment - servers, workstations, and network-boot systems - lose the ability to renew or obtain IP leases until an administrator manually restarts the daemon, potentially affecting dozens to thousands of hosts in large enterprise environments.