SUSE wicked CVE-2026-71402

The target host must be running wickedd-dhcp4 and must be actively seeking or maintaining a DHCPv4 lease - the DHCP client must be listening for or processing DHCP responses. The attacker must be on the same Layer-2 network segment (same broadcast domain or VLAN) as the target, as DHCP operates via link-local broadcast and the CVSS 4.0 vector specifies AV:A (adjacent network). No authentication is required (PR:N). Exploitation is limited by: the attacker having no control over the specific bytes adjacent to the receive buffer in the target heap; the over-read being bounded to a maximum of 68 bytes; the absence of a confirmed memory write primitive; and the hard requirement for Layer-2 adjacency rather than arbitrary internet-routable access. Non-default configurations are not required - any host using wicked for DHCP is potentially exposed.

The CVSS 4.0 score of 5.3 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) accurately captures a bounded but real local-network threat. Adjacent-network positioning (AV:A) is a genuine constraint - exploitation requires the attacker to operate on the same broadcast domain or VLAN as the wicked client, substantially limiting exposure compared to internet-reachable vulnerabilities. The over-read is strictly capped at 68 bytes with no demonstrated write primitive, no attacker control over the adjacent heap bytes, and no confirmed remote exfiltration channel, making direct pivot to code execution undemonstrated and unlikely without a separate chained primitive. The low integrity signal (VI:L) reflects that heap data misinterpreted as DHCP options may corrupt lease configuration state on the affected host. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified; KEV status is not confirmed, indicating no known widespread active exploitation at time of analysis. No public proof-of-concept exploit has been identified. The realistic threat model is a rogue DHCP server or attacker-controlled switch port on the same segment using heap layout disclosure as reconnaissance toward a chained memory-corruption attack.

An attacker positioned on the same network segment as a host running wickedd-dhcp4 sends a crafted UDP packet with a manipulated IP total length field that exceeds the actual packet payload size. When the wicked DHCPv4 client processes this packet, ni_capture_inspect_udp_header() uses the malicious ip_len value as the payload length, causing the DHCP option walker to read up to 68 bytes past the end of the receive buffer and interpret adjacent heap memory - potentially including heap allocator metadata or pointer values - as DHCP option fields, which may then be stored in the client's DHCP lease state. No public proof-of-concept has been identified at time of analysis.