CVE-2026-71402: wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length
An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wickedto a version that resolves this vulnerability.Fixed in 0.6.80 - Compensating control
Mitigate exposure by preventing untrusted hosts on the same network from sending crafted DHCP/UDP packets to vulnerable clients (e.g., restrict/segment DHCP client networks and limit who can access the client DHCP/UDP capture path).
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems running the wicked DHCPv4 client, wickedd-dhcp4, at version 0.6.80 or earlier are affected when they can receive DHCP/UDP traffic from an attacker on the same network. The issue is in DHCPv4 packet capture and parsing, not a service reachable from arbitrary remote networks.
What does an attacker need to exploit it?
An attacker needs no authentication, user interaction, or prior privileges, but must be able to send a crafted DHCP/UDP packet on the victim's local network. Exploitation causes the client to interpret up to 68 bytes beyond its 1500-byte receive buffer as DHCP options.
What is the practical impact of the out-of-bounds read?
The bounded over-read can cause adjacent heap data, including allocator metadata or pointer values, to be interpreted as DHCP lease fields. The available information does not demonstrate a memory write, attacker control of the adjacent data, or a remote primitive to exfiltrate that memory.
How can exposure be reduced if an update cannot be applied immediately?
Limit untrusted devices' ability to send DHCP/UDP traffic on the local network where affected DHCPv4 clients operate. This reduces the ability of an unauthenticated local-network attacker to deliver the crafted packet required for the issue.