Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
dhcpcd may let nearby attackers corrupt memory
published 4 months ago
Summary
The dhcpcd program (versions before 10.0.8-2) can be fooled by a specially crafted network message to write data outside its intended memory area. This could let an attacker on the same local network tamper with the program's operation, potentially leading to crashes or other unwanted behavior. Update dhcpcd to the latest version or apply the provided patch to stop the problem.
What to do
- Update azure dhcpcd to version 10.0.8-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | dhcpcd |
< 10.0.8-2 Fix: upgrade to 10.0.8-2
|
Original advisory text
CVE-2026-56114 affecting package dhcpcd for versions less than 10.0.8-2
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
References
Timeline
Published23 Jun 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-90216 · OSV
Track software like this
Free during beta