Skip to main content

open-iscsi iscsiuio EUVDEUVD-2026-57637

| CVE-2026-18727 MEDIUM
Integer Underflow (CWE-191)
2026-08-12 redhat GHSA-g663-r6hr-qmc2
Buffer Overflow Denial Of Service Integer Overflow Microsoft Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9 Red Hat
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Adjacent-network vector required, no authentication needed, impact is DoS-only via iscsiuio crash; fully consistent with the vendor-provided vector.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 12, 2026 - 21:55 vuln.today
CVE Published
Aug 12, 2026 - 21:13 cve.org
MEDIUM 6.5

DescriptionCVE.org

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

AnalysisAI

Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.

Technical ContextAI

The iscsiuio daemon within open-iscsi handles userspace I/O for iSCSI initiators, including DHCPv6-based IPv6 address acquisition on iSCSI network interfaces. CWE-191 (Integer Underflow) is the root cause: when a DHCPv6 Advertise packet carries a UDP length field smaller than the minimum expected value, the arithmetic to derive the DHCPv6 payload length wraps below zero, producing a very large unsigned integer. This corrupted length is subsequently used to index into a buffer, triggering an out-of-bounds read that crashes the process. The flaw is constrained to the DHCPv6 parsing code path and activates only while the client is awaiting a DHCPv6 Advertise response. Affected products per CPE are cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:* and cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*, as shipped by Red Hat.

RemediationAI

Apply the Red Hat-provided update for the open-iscsi package on RHEL 9 and RHEL 10 via standard package management (dnf update open-iscsi) once released; monitor https://access.redhat.com/security/cve/CVE-2026-18727 for the patched package version, which is not confirmed in the current data. As an immediate compensating control, if DHCPv6 is not required for iSCSI interface address assignment, disable DHCPv6 on iSCSI network interfaces by switching to static IPv6 addressing - this removes the vulnerable code path entirely but requires manual address management and may affect automation workflows. Alternatively, enforce strict VLAN isolation and IPv6 ACLs on iSCSI storage networks to limit which adjacent hosts can transmit DHCPv6 Advertise packets toward initiators, reducing the attacker pool; note this does not eliminate the flaw if a trusted adjacent host is compromised. Monitoring iscsiuio process health and setting automatic restart (e.g., via systemd service restart policies) can limit the operational impact of an unexpected crash but does not prevent exploitation.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

EUVD-2026-57637 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy