Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-56114: dhcpcd may let local network attacker corrupt memory
CVE-2026-56114 · published 4 months ago
Summary
Versions of the dhcpcd client up to 10.3.2 (including Debian and other builds) can be tricked by a specially crafted IPv6 DHCP message to write data outside its intended storage area. This could allow an unauthenticated device on the same network segment to alter the program’s memory, potentially leading to crashes or further misuse. Update dhcpcd to the latest released version that includes the fix, or apply the provided patch, to eliminate the risk.
What to do
- Update bellsoft dhcpcd to version 9.4.1-r4.
- Update bellsoft dhcpcd to version 10.2.3-r1.
- Update bellsoft dhcpcd to version 10.3.2-r1.
- Update dhcpcd to version 10.5.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | dhcpcd | All versions |
| Debian:14 | debian | dhcpcd | All versions |
| – | dhcpcd_project | dhcpcd |
<= 10.3.2 cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:* |
| Alpaquita:23 | bellsoft | dhcpcd |
>= 9.4.1-r1, < 9.4.1-r4 Fix: upgrade to 9.4.1-r4
|
| Alpaquita:25 | bellsoft | dhcpcd |
>= 10.2.3-r0, < 10.2.3-r1 Fix: upgrade to 10.2.3-r1
|
| Alpaquita:stream | bellsoft | dhcpcd |
>= 9.4.1-r3, < 10.3.2-r1 Fix: upgrade to 10.3.2-r1
|
| – | networkconfiguration | dhcpcd | <= 10.3.2 |
| Alpine:v3.23 | – | dhcpcd |
< 10.5.2-r0 Fix: upgrade to 10.5.2-r0
|
Original advisory text
dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
References
- https://docs.bell-sw.com/security/cves/CVE-2026-56114 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56114... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56114 Vendor Advisory
- https://github.com/NetworkConfiguration/dhcpcd Product
- https://security-tracker.debian.org/tracker/CVE-2026-56114 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-56114 Vendor Advisory
- https://www.vulncheck.com/advisories/dhcpcd-stack-out-of-bounds-write-in-dhcp6-m... Vendor Advisory
- https://github.com/NetworkConfiguration/dhcpcd/commit/2f00c7bfc408b6582d331932df... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-787Out-of-bounds Write
Timeline
Published23 Jun 2026
Updated4 Nov 2026
First seen23 Jun 2026
Sources
BELL-CVE-2026-56114 · OSV
CVE-2026-56114 · NVD
CVE-2026-56114 · MITRE
CVE-2026-56114 · OSV
DEBIAN-CVE-2026-56114 · OSV
ALPINE-CVE-2026-56114 · OSV
Track software like this
Free during beta