FreeBSD dhclient CVE-2026-42511

Requires victim FreeBSD system to obtain DHCP leases from attacker-controlled or attacker-intercepted DHCP server responses. Exploitation specifically depends on network topology allowing rogue DHCP server deployment or DHCP response spoofing-feasible on untrusted networks (public WiFi, guest networks, physically accessible Ethernet ports) or through compromise of existing DHCP infrastructure. The vulnerability triggers upon dhclient re-parsing its lease file, which occurs during system restarts, dhclient daemon restarts, or explicit lease renewal operations. No user interaction required (UI:N) once the malicious lease is obtained. Systems using static IP configuration or isolated from untrusted DHCP servers are not exploitable. The high attack complexity (AC:H) reflects the requirement for network-layer access and DHCP server positioning, limiting exploitation to scenarios where attackers have network adjacency or can perform layer-2 man-in-the-middle attacks.

Real-world risk assessment reveals significant nuance. CVSS 8.1 (High) reflects the severe impact-root code execution with full confidentiality, integrity, and availability compromise. However, AC:H (high attack complexity) requires the attacker to position a rogue DHCP server on the victim's network or perform a man-in-the-middle attack, substantially limiting exploitation scenarios. EPSS score of 0.02% (5th percentile) indicates extremely low observed exploitation probability in the wild, aligning with SSVC's 'Exploitation: none' status. The SSVC framework marks this as 'Automatable: yes' but 'Technical Impact: partial'-note the discrepancy where CVSS indicates high impact across all CIA triad elements while SSVC assesses partial impact, likely reflecting that exploitation requires specific network positioning rather than internet-wide scanning. No CISA KEV listing confirms this is not being actively exploited at scale. This is a genuine high-severity vulnerability for environments with untrusted network infrastructure (public WiFi, guest networks, compromised network equipment) but lower priority for enterprise networks with controlled DHCP infrastructure and network segmentation. The persistence aspect-exploitation triggers on system restart-makes it particularly concerning for laptops moving between networks.

Attacker operates a rogue DHCP server on a network segment accessible to the target FreeBSD system, either by physically connecting to public/guest WiFi networks or compromising existing network infrastructure. When the victim system requests a DHCP lease, the malicious server responds with a crafted BOOTP file field containing injected dhclient.conf directives embedded with unescaped double-quotes (e.g., 'option"; malicious-directive "'). The FreeBSD dhclient writes this to its lease file without sanitization. Upon next system restart or dhclient process restart, the lease file is re-parsed, malicious directives execute via dhclient-script with root privileges, granting the attacker complete system control. No public exploit code identified at time of analysis, though the injection technique is straightforward for attackers with DHCP protocol knowledge.