CVE-2026-56114: dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTIONPDEXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IAPD IAPREFIX /0 with a valid OPTIONPDEXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dhcpcd (dhcp6_makemessage in src/dhcp6.c)to a version that resolves this vulnerability.Fixed in 10.3.2Patch commit 2f00c7b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56114?
CVE-2026-56114 has a medium severity rating of 6.
How do I fix CVE-2026-56114?
To fix CVE-2026-56114, update dhcpcd to the version that includes the fix from commit 2f00c7b.
What type of vulnerability is CVE-2026-56114?
CVE-2026-56114 is a stack out-of-bounds write vulnerability found in the dhcp6_makemessage() function.
Who is affected by CVE-2026-56114?
CVE-2026-56114 affects installations of dhcpcd through version 10.3.2.
What can attackers achieve with CVE-2026-56114?
Attackers can exploit CVE-2026-56114 to write beyond a fixed local buffer, potentially leading to denial of service.