What is the CVSS score of EUVD-2026-26350?

EUVD-2026-26350 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD dhclient are affected by EUVD-2026-26350?

CVE-2026-42511 is a high-severity remote code execution vulnerability in FreeBSD dhclient that allows unauthenticated attackers on the network to execute arbitrary commands with root privileges by…

How to fix or mitigate EUVD-2026-26350?

Within 24 hours: Identify all FreeBSD systems using dhclient for DHCP configuration via network discovery or asset management tools; document current dhclient versions. Within 7 days: Implement network segmentation to restrict DHCP server access to trusted infrastructure only; disable DHCP on systems where static IP configuration is feasible. Within 30 days: Monitor FreeBSD security advisories for vendor patch release; establish a patching plan for immediate deployment when available; consider temporary mitigation of running dhclient only when necessary or switching to alternative DHCP clients if available.

FreeBSD dhclient EUVD-2026-26350

| CVE-2026-42511 HIGH

Improper Neutralization of Quoting Syntax (CWE-149)

2026-04-30 freebsd

RCE Freebsd

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

May 01, 2026 - 16:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 01, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 01, 2026 - 16:22 NVD

7.3 (HIGH) 8.1 (HIGH)

Analysis Generated

Apr 30, 2026 - 14:22 vuln.today

CVSS changed

Apr 30, 2026 - 14:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 07:15 euvd

EUVD-2026-26350

Analysis Generated

Apr 30, 2026 - 07:15 vuln.today

CVE Published

Apr 30, 2026 - 06:56 nvd

HIGH 8.1

DescriptionCVE.org

The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.

A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.

AnalysisAI

Remote code execution as root in FreeBSD dhclient allows malicious DHCP servers to inject arbitrary commands via unsanitized BOOTP file field in DHCP responses. When dhclient writes lease data without escaping embedded double-quotes and later re-parses it (e.g., after system restart), injected dhclient.conf directives execute through dhclient-script. EPSS score is notably low (0.02%, 5th percentile) with SSVC indicating no observed exploitation and partial technical impact, suggesting limited real-world targeting despite the high-severity nature of root code execution. No public exploit code identified at time of analysis.

Technical ContextAI

DHCP (Dynamic Host Configuration Protocol) clients like FreeBSD's dhclient receive configuration data from DHCP servers, including the BOOTP file field (typically used for network boot file paths). The vulnerability stems from CWE-149 (Improper Neutralization of Quoting Syntax), where dhclient fails to escape double-quote characters when writing the BOOTP file field to its lease database file. When dhclient subsequently re-parses this lease file-either on daemon restart or system reboot-the maliciously crafted field is interpreted as dhclient.conf configuration directives rather than data. These directives are then passed to dhclient-script, a shell script that executes with root privileges to configure network interfaces. The affected CPE (cpe:2.3:a:freebsd:freebsd) identifies the FreeBSD base system's DHCP client implementation. This is a classic quote injection vulnerability where insufficient input sanitization allows data fields to break out of their intended context and become executable code.

RemediationAI

Apply FreeBSD security patches immediately: upgrade to FreeBSD 13.5-RELEASE-p13, 14.3-RELEASE-p12, 14.4-RELEASE-p3, or 15.0-RELEASE-p7 depending on your major version branch. Patches available through freebsd-update utility or by rebuilding from patched sources as detailed in FreeBSD-SA-26:12.dhclient advisory (https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc). For systems where immediate patching is not feasible, configure static IP addressing to eliminate DHCP client usage entirely-this prevents exploitation but sacrifices automatic network configuration and may complicate mobile device management. Alternatively, restrict DHCP server access via network segmentation and MAC address filtering on switching infrastructure to allow only trusted DHCP servers, though this requires existing network access control infrastructure and does not protect against compromised legitimate servers. Organizations using FreeBSD in untrusted network environments (laptops on public networks) should prioritize patching over mitigations due to the severity of root code execution.