wicked CVE-2026-71401

The target host must be running the wickedd-dhcp4 daemon actively listening for DHCPv4 packets - this is the default on SUSE Linux Enterprise and openSUSE systems configured to use DHCP for network addressing. The attacker must be on the same Layer-2 network segment (same physical LAN, VLAN, or wireless network) as the target, as the CVSS AV:A rating confirms; remote internet-based exploitation is not possible. No authentication is required (PR:N), and no user interaction is needed. Exploitation success is non-deterministic: the crash 'depends on the process memory layout,' meaning the out-of-bounds read may not always produce a fault. Hosts using static IP configuration with wickedd-dhcp4 not running are not affected.

The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N with a score of 5.3 accurately reflects the constrained real-world risk. The adjacent-network attack vector (AV:A) is the most significant limiting factor - the attacker must be on the same Layer-2 network segment as the target, such as a shared LAN, VLAN, or wireless segment, substantially reducing the exploitable population compared to internet-facing vulnerabilities. Availability impact is rated Low (VA:L), consistent with the description that daemon crash 'depends on the process memory layout,' meaning exploitation may be unreliable. There is no confirmed active exploitation (not in CISA KEV), no public exploit code, and no EPSS data provided. Critically, the tags include 'Information Disclosure,' which directly contradicts the CVE description stating 'no information disclosure has been demonstrated' - this tag appears to be erroneous metadata and should not be treated as confirmed. Real-world priority is low-to-moderate: the crash is recoverable, requires network proximity, and affects a SUSE-specific daemon rather than a broadly deployed service.

An attacker positioned on the same LAN segment as a SUSE Linux host running wickedd-dhcp4 crafts a raw DHCPv4 response packet with the IP header's total length field (ip_len) set to a value smaller than the IP header length (ihl). When the wicked daemon processes this packet in ni_capture_inspect_udp_header(), the unguarded subtraction wraps to a large unsigned integer, and the subsequent read extends past the allocated receive buffer. Depending on the process memory layout, this out-of-bounds read causes a segmentation fault and crashes the daemon, disrupting network configuration on the target host. No public proof-of-concept exploit exists, and crash reliability is layout-dependent.