CVE-2026-71401: wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read
An integer underflow was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader() in src/capture.c does not verify that the IP total length field (iplen) is at least as large as the IP header length (ihl) before subtracting the header length. An unauthenticated attacker on the same network can thereby trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client (wickedd-dhcp4), which can crash the daemon depending on the process memory layout. No information disclosure has been demonstrated. This issue affects wicked up to and including version 0.6.80.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wicked/wickedd-dhcp4to a version that resolves this vulnerability.Fixed in 0.6.80 - Compensating control
Because exploitation is possible by an unauthenticated attacker on the same network, restrict network access to the DHCPv4 service so only trusted clients can reach wicked (wickedd-dhcp4).
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the wicked DHCPv4 client daemon, wickedd-dhcp4, are exposed if they use wicked version 0.6.80 or earlier and can receive attacker-supplied packets from the same network.
What does an attacker need to exploit the flaw?
The attacker does not need authentication, but must be on the same network and able to send a malformed DHCPv4 packet with an IP total-length field smaller than the IP header length.
What is the expected impact of exploitation?
The malformed packet can cause wickedd-dhcp4 to read beyond its receive buffer and may crash the daemon depending on the process memory layout. No information disclosure has been demonstrated.
Is a configuration change required for exposure?
The affected code is in the wicked DHCPv4 packet-capture path used by wickedd-dhcp4. The provided information does not identify any configuration setting that must be enabled beyond running the affected DHCPv4 client daemon.