Buffer Overflow Vulnerability in open-iscsi's iscsiuio Component
CVE-2026-115484

7.6HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115484?

A vulnerability exists within the iscsiuio component of open-iscsi, where a flaw in the DHCPv4 option parser leads to improper length calculation of options data. This flaw can cause the daemon to read beyond the allocated buffer, potentially crashing the service or corrupting network settings. Attackers on the same network segment can exploit this by sending a specially crafted DHCP response, aiming to compromise the integrity of the network configuration.

References

https://access.redhat.com/security/cve/CVE-2026-115484
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2556265
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue.
.