Severity by source
DHCP operates over adjacent Layer 2 broadcast domain (AV:A); no auth needed; OOB read yields memory disclosure (C:L) and possible crash (A:L) but no write impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
[rx_ip truncated DHCP options size_t underflow OOB read]
AnalysisAI
Out-of-bounds read in DHCP options parsing exposes systems running an Ubuntu-maintained networking component to potential memory disclosure or denial-of-service when processing malformed DHCP packets. The vulnerability arises from a size_t integer underflow in the rx_ip path when handling truncated DHCP options fields, allowing an attacker-controlled DHCP server on the local network segment to trigger reads beyond allocated buffer boundaries. No public exploit code has been identified at time of analysis, and exploitation probability data is unavailable due to the recency of this disclosure.
Technical ContextAI
The vulnerability resides in IP packet receive processing (rx_ip) within a DHCP client or network stack component maintained in Ubuntu's package ecosystem. DHCP options are variable-length fields appended to the fixed BOOTP header; parsers must validate that each option's declared length does not exceed remaining buffer space. Here, when DHCP options are truncated - meaning the packet ends before the declared options length is satisfied - a subtraction of the consumed offset from the total buffer size produces a size_t underflow. Because size_t is an unsigned type, the underflow wraps to a very large positive value (e.g., 0xFFFFFFFF... on 64-bit), causing a subsequent read loop or memcpy to access memory far beyond the intended buffer boundary. The root cause class is CWE-191 (Integer Underflow) leading to CWE-125 (Out-of-Bounds Read). Exact affected package and version are not confirmed in the available data; CPE strings were not provided.
Affected ProductsAI
The affected product is an Ubuntu-maintained networking component involved in DHCP packet processing, specifically in the rx_ip code path that handles incoming DHCP option fields. The exact package name (e.g., dhcpcd, isc-dhcp-client, systemd-networkd, or a kernel networking module), affected versions, and CPE strings were not provided in the available intelligence. Ubuntu's vendor disclosure is the only confirmed source. Administrators should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE tracker at ubuntu.com/security/CVE-2026-52067 for package-specific version information as it becomes available.
RemediationAI
Monitor Ubuntu Security Notices for an official USN advisory addressing CVE-2026-52067, which will specify the exact patched package version. No vendor-released patch version has been independently confirmed at time of analysis. As an interim compensating control, administrators can restrict DHCP client exposure by ensuring systems only accept DHCP responses from trusted network infrastructure - where possible, use static IP assignment to eliminate DHCP client attack surface entirely, accepting the operational trade-off of increased configuration overhead. On segmented networks, enforce DHCP snooping on managed switches to prevent rogue DHCP servers from reaching client systems; this is the most operationally practical mitigation with minimal side effects. If the affected component can be identified, consider disabling or sandboxing the DHCP client process using systemd service hardening (e.g., MemoryDenyWriteExecute, RestrictAddressFamilies) to limit the blast radius of a successful OOB read to the client process rather than the broader system.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today