CVE-2026-115863: Buffer Overflow
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME (1025) bytes from a DHCPv6 DOMAINLIST (option 24) value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAINLIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAINLIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running ConnMan through 2.0 that can receive DHCPv6 traffic from an attacker on the same network link are exposed. The described attack requires the attacker to be on-link, not remotely reachable across arbitrary routed networks.
What does an attacker need to exploit it?
No authentication or prior privileges are required. An attacker needs to forge a Router Advertisement with O=1 and a DHCPv6 Reply that matches the target's xid and CLIENTID and contains a long DOMAIN_LIST option.
What is the likely impact of a successful attack?
The described impact is an unauthenticated crash of connmand, which runs as root. The vulnerability causes an out-of-bounds stack buffer access while processing the DHCPv6 DOMAIN_LIST option.
How can I determine whether my deployment is affected?
Check whether ConnMan is in use and whether its version is 2.0 or earlier. Also determine whether the device uses DHCPv6 and can be reached by untrusted hosts on the same network link.