open-iscsi CVE-2026-18728

Exploitation requires the attacker to be present on the same Layer-2 local network segment as the target host (AV:A - adjacent network; internet-sourced exploitation is not possible). The target system must be running the iscsiuio daemon and must be actively handling IPv4 DHCP traffic - as explicitly stated in the description: 'This issue affects systems where iscsiuio is actively handling IPv4 DHCP traffic.' No attacker authentication is required (PR:N per CVSS vector). No user interaction is needed (UI:N). Hosts that do not run iscsiuio, that have it masked or stopped, or that do not use IPv4 DHCP via iscsiuio (e.g., systems using standard kernel DHCP without iSCSI offload) are not affected. The adjacent-network constraint is the primary limiting factor narrowing the realistic attacker pool to insiders, co-tenants on shared LAN infrastructure, or attackers who have already achieved some level of network access.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.5) accurately captures the key risk dimensions: the attack is constrained to adjacent-network segments, requires no authentication or user interaction, and produces a high availability impact with no confidentiality or integrity consequence. The adjacent-network constraint is the dominant risk-reduction factor compared to fully remote (AV:N) vulnerabilities of equivalent score - the attacker must already have Layer-2 access to the same network segment as the target. EPSS data is not included in the available intelligence, and neither CISA KEV listing nor confirmed public proof-of-concept code have been identified, suggesting no active attacker tooling at time of analysis. Even a mid-sized municipal IT team in kielce running iSCSI storage-area networks should prioritize patching if iscsiuio is exposed to any untrusted or shared LAN segment, particularly in network-boot environments where daemon availability is a dependency for host operation. The missing EPSS score and absence of a confirmed fix version in the current data set introduce moderate analytical uncertainty - this is a real but operationally bounded vulnerability, not a critical emergency for most deployments.

An attacker positioned on the same Layer-2 network segment as a Linux host running iscsiuio with active IPv4 DHCP handling crafts a malformed DHCP reply packet with a manipulated length field designed to drive the integer underflow. The iscsiuio daemon processes the reply, the underflow triggers an out-of-bounds read, and the process crashes - interrupting iSCSI storage or network-boot connectivity for that host. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) and absence of authentication requirements mean the attack is straightforward for any adjacent-network attacker with basic packet-crafting capability.