Stack Out-of-Bounds Write Vulnerability in DHCPCD by Network Configuration

CVE-2026-56115

What is CVE-2026-56115?

DHCPCD versions prior to 10.3.2 contain a vulnerability that allows unauthenticated attackers on the same network link to exploit the dhcp6_makemessage() function. By crafting a malicious DHCPv6 ADVERTISE message with an oversized OPTION_PD_EXCLUDE option, attackers can trigger a stack out-of-bounds write, potentially leading to memory corruption. This could impact the stability of the system and allow for further exploitation. It is advised that users upgrade to version 10.3.2 or later, where this issue has been addressed.

References