open-iscsi iscsiuio EUVD-2026-108555

Exploitation requires that the target be running the iscsiuio daemon - the open-iscsi userspace component used for iSCSI offload (typically Broadcom bnx2/cnic NICs) - and that it be processing DHCPv4 for iSCSI configuration; the daemon must be active and soliciting DHCP for the parser to be reached. The attacker must be on the same network segment / broadcast domain (AV:A) to deliver a crafted DHCPv4 response, so the flaw is not remotely reachable across routed networks. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N). Primary realistic outcome is a daemon crash and network-config corruption with incidental heap disclosure; the specific overflowed field is the DHCPv4 options length, per the description. Limiting factors: Layer-2 adjacency, iscsiuio being deployed and running, and DHCP-driven iSCSI configuration - systems not using iSCSI offload/DHCP are not exposed.

This is a moderate-priority issue rather than a drop-everything emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 7.6) describes an adjacent-network, low-complexity, unauthenticated flaw whose dominant impact is availability (A:H, daemon crash) with secondary low confidentiality and integrity impact (C:L/I:L) from reading adjacent heap memory and corrupting network configuration - matching the CWE-125 out-of-bounds read and the description precisely. The vuln.today Decision label is 'this_week', not act_now or emergency, which aligns with a serious-but-not-wormable bug. No CISA KEV listing is present (status: no confirmed active exploitation), no EPSS score was supplied so exploitation probability cannot be quantified, and no PoC or exploit reference appears in the input (no public exploit identified at time of analysis). The key risk limiter is AV:A: the attacker must sit on the same Layer-2 segment/broadcast domain to inject a rogue DHCPv4 response, so this is not internet-exposed. Net: a legitimate patch-this-week item for environments actually running iscsiuio, not a high-CVSS-but-illusory finding, but also not evidence of mass exploitation. EPSS and PoC data are MISSING - do not treat absence as proof of safety.

An attacker already present on the same network segment (e.g. a compromised host or rogue device in the same VLAN/broadcast domain) races or spoofs a crafted DHCPv4 response to a system whose iscsiuio daemon is soliciting DHCP for iSCSI configuration. The malformed options field drives the parser's miscalculated length past the allocated heap buffer, crashing the daemon (denial of service) or corrupting its iSCSI network configuration, with a secondary leak of adjacent heap bytes. No public exploit code was identified in the provided sources.