Heap Use-After-Free Vulnerability in dhcpcd by Network Configuration

CVE-2026-56113

What is CVE-2026-56113?

The identified vulnerability in dhcpcd versions up to 10.3.2 allows unauthenticated attackers to exploit a heap use-after-free condition. This is executed by sending a specially crafted DHCPv6 RENEW reply that includes the OPTION_PD_EXCLUDE with both preferred and valid lifetimes set to zero. If exploited, this vulnerability can cause the daemon to crash when attackers impersonate a DHCPv6 server, resulting in the freeing of a delegated child address while an iterator still holds a pointer to it. This scenario leads to a use-after-free condition during address deprecation, severely undermining the stability and security of affected systems.

References