Stack-Based Buffer Overflow in ConnMan Due to Malicious DHCPv6 Replies

CVE-2026-115863

What is CVE-2026-115863?

A stack-based buffer overflow vulnerability exists in ConnMan through version 2.0, triggered by a malicious DHCPv6 Reply message. This flaw is found in the 'get_domains' function within gdhcp/client.c, where the software erroneously copies a fixed size of 1025 bytes from a potentially oversized DHCPv6 DOMAIN_LIST into a 1026-byte stack buffer, failing to verify the size of the data being handled. As a result, an attacker can exploit this vulnerability by sending a specially crafted DHCPv6 Reply containing a DOMAIN_LIST option that is at least 1025 bytes long, allowing for an unbounded character increment, which can result in the reading or writing of memory past the buffer's end. This vulnerability can be exploited locally by an attacker without the need for authentication, potentially leading to an unauthorized crash of the connmand process, which operates with root privileges.

References