Alpine lldpd CVE-2026-46433
MEDIUM
Out-of-bounds Read (CWE-125)
N/A
vendor:alpine
6.5
CVSS 3.1 · Vendor: vendor:alpine
Share
Severity by source
Vendor (vendor:alpine)
PRIMARY
6.5
MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Lifecycle Timeline
2
CVSS changed
Jun 09, 2026 - 23:22 NVD
6.5 (MEDIUM)
Analysis Generated
May 27, 2026 - 22:47 vuln.today
DescriptionCVE.org
Alpine Linux: lldpd fixed in 1.0.22-r0
AnalysisAI
lldpd on Alpine Linux was patched in package version 1.0.22-r0, addressing an unspecified vulnerability in the Link Layer Discovery Protocol daemon. The exact nature of the flaw - whether remote code execution, denial of service, information disclosure, or privilege escalation - is not disclosed in available data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Gain adjacent network access
Delivery
Craft malicious LLDP frame
Exploit
Deliver frame to target interface
Execution
Trigger unspecified flaw in lldpd parser
Impact
Achieve unknown impact
Access
Gain adjacent network access
Delivery
Craft malicious LLDP frame
Exploit
Deliver frame to target interface
Execution
Trigger unspecified flaw in lldpd parser
Impact
Achieve unknown impact
Vulnerability AssessmentAI
| Exploitation | Specific exploitation conditions cannot be determined because CVSS vector, CWE, and a detailed description are all absent. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk cannot be meaningfully quantified from available data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a network segment adjacent to the target host - or positioned to inject crafted LLDP frames - could potentially trigger the vulnerability by sending malformed LLDP packets to a host running the unpatched lldpd daemon. The exact exploit primitive (crash, code execution, information leak) is unknown due to absent CVSS and CWE data. … |
| Remediation | Upgrade the Alpine Linux lldpd package to version 1.0.22-r0 or later using 'apk upgrade lldpd'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).