EUVD-2026-38494
GHSA-vhmp-9f3g-3f36
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Same-link rogue server needs no auth or interaction (AV:A/AC:L/PR:N/UI:N); single-byte stack write reliably crashes the client (A:H) with limited write control (I:L) and no data disclosure (C:N).
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
AnalysisAI
Stack out-of-bounds write in dhcpcd (the widely-used DHCP/DHCPv6 client) through version 10.3.2 lets a same-link attacker corrupt client stack memory by replying with a malicious DHCPv6 ADVERTISE. When dhcpcd serializes an oversized RFC6603 OPTION_PD_EXCLUDE body in dhcp6_makemessage(), a one-byte value is written past a fixed 16-byte stack buffer. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV, but a vendor fix (commit 2f00c7b) is available.
Technical ContextAI
dhcpcd is a DHCP and DHCPv6 client used to obtain IPv4/IPv6 addresses and, via DHCPv6 prefix delegation (IA_PD, RFC 3633), to request and re-advertise routable prefixes. The flaw is a CWE-787 out-of-bounds write in src/dhcp6.c. RFC 6603 defines OPTION_PD_EXCLUDE, which encodes an excluded sub-prefix relative to a delegated prefix; dhcpcd reflects the exclude option received in a server ADVERTISE back into its outgoing REQUEST. The vendor diff confirms the root cause precisely: the local serialization buffer was declared uint8_t exb[16] and the fix enlarges it to exb[17], showing that an exclude prefix length in the /121-/128 range produces a serialized body one byte longer than the buffer accommodates, overflowing the fixed-size stack array by a single byte.
RemediationAI
Update dhcpcd to a release containing the upstream fix, commit 2f00c7b (one-line change enlarging the exb buffer from 16 to 17 bytes); since the public reference is the commit rather than a tagged release, treat this as 'upstream fix available (PR/commit); released patched version not independently confirmed' and pin to your distribution's patched package once published, or build from a tree including 2f00c7b. Until patched, the practical compensating control is to avoid using or accepting DHCPv6 prefix delegation on untrusted links: disable IA_PD requests in dhcpcd.conf (remove 'ia_pd'/prefix-delegation directives) where PD is not needed, which prevents the vulnerable exclude-option serialization path but loses delegated-prefix functionality. Additionally, deploy DHCPv6 guard / RA-Guard on access switches and restrict which hosts may answer DHCPv6 on the segment to blunt rogue-server replies, accepting the operational overhead of maintaining trusted-server allow-lists. Track the VulnCheck advisory (https://www.vulncheck.com/advisories/dhcpcd-stack-out-of-bounds-write-in-dhcp6-makemessage) for a fixed version number.
dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-0
dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature. Rated c
dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses. Rated critical s
Stack-based buffer overflow in the get_packet method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a deni
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related t
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bound
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bound
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP ser
Denial of service in dhcpcd through version 10.3.2 allows an adjacent-network attacker to exhaust memory in the daemon b
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products
Stack memory corruption in dhcpcd through 10.3.2 exposes systems running the DHCPv6 client to availability disruption fr
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| SLES-CHOST-BYOS-Aliyun | Affected |
| SLES-CHOST-BYOS-Azure | Affected |
| SLES-CHOST-BYOS-EC2 | Affected |
| SLES-CHOST-BYOS-GCE | Affected |
| SLES-CHOST-BYOS-GDC | Affected |
| SLES-CHOST-BYOS-SAP-CCloud | Affected |
Share
External POC / Exploit Code
Leaving vuln.today