CVE-2026-115484
Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
CVE-2026-115484- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-108555
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
EUVD-2026-108555- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-phc9-9w6c-6974
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly...
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
GHSA-phc9-9w6c-6974- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
CVE-2026-115484- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-115484
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
DEBIAN-CVE-2026-115484- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-115484
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
UBUNTU-CVE-2026-115484- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVAZL-111395 No score
CVE-2026-115484 affecting package iscsi-initiator-utils 2.1.12-1
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
- Record
AZL-111395- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iscsi-initiator-utilsAzure Linux:3 |
through 2.1.12-1 | None known |
open-iscsiDebian:12 |
All versions, plus listed versions 2.1.10-12.1.10-22.1.10-32.1.11-12.1.11-2 Show 14 moreShow less2.1.11-32.1.11-42.1.11-52.1.11-62.1.12-12.1.12-22.1.13-12.1.8-12.1.8-1+deb12u12.1.8-22.1.9-12.1.9-22.1.9-32.1.9-4 |
None known |
open-iscsiDebian:13 |
All versions, plus listed versions 2.1.11-12.1.11-1+deb13u12.1.11-1+deb13u22.1.11-22.1.11-3 Show 6 moreShow less2.1.11-42.1.11-52.1.11-62.1.12-12.1.12-22.1.13-1 |
None known |
open-iscsiDebian:14 |
All versions, plus listed versions 2.1.11-12.1.11-22.1.11-32.1.11-42.1.11-5 Show 4 moreShow less2.1.11-62.1.12-12.1.12-22.1.13-1 |
None known |
open-iscsiUbuntu:14.04:LTS |
All versions, plus listed versions 2.0.873-3ubuntu72.0.873-3ubuntu82.0.873-3ubuntu9 |
None known |
open-iscsiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.0.873-3ubuntu132.0.873+git0.3b4b4500-13ubuntu32.0.873+git0.3b4b4500-14ubuntu12.0.873+git0.3b4b4500-14ubuntu32.0.873+git0.3b4b4500-14ubuntu3.1 Show 7 moreShow less2.0.873+git0.3b4b4500-14ubuntu3.22.0.873+git0.3b4b4500-14ubuntu3.32.0.873+git0.3b4b4500-14ubuntu3.42.0.873+git0.3b4b4500-14ubuntu3.52.0.873+git0.3b4b4500-14ubuntu3.62.0.873+git0.3b4b4500-14ubuntu3.72.0.873+git0.3b4b4500-14ubuntu3.7+esm1 |
None known |
open-iscsiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.0.874-4ubuntu32.0.874-4ubuntu42.0.874-4ubuntu52.0.874-5ubuntu12.0.874-5ubuntu2 Show 10 moreShow less2.0.874-5ubuntu2.12.0.874-5ubuntu2.22.0.874-5ubuntu2.32.0.874-5ubuntu2.42.0.874-5ubuntu2.62.0.874-5ubuntu2.72.0.874-5ubuntu2.92.0.874-5ubuntu2.102.0.874-5ubuntu2.112.0.874-5ubuntu2.11+esm1 |
None known |
open-iscsiUbuntu:20.04:LTS |
All versions, plus listed versions 2.0.874-7.1ubuntu32.0.874-7.1ubuntu52.0.874-7.1ubuntu62.0.874-7.1ubuntu6.12.0.874-7.1ubuntu6.22.0.874-7.1ubuntu6.32.0.874-7.1ubuntu6.42.0.874-7.1ubuntu6.5 |
None known |
open-iscsiUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.4-0ubuntu12.1.4-0ubuntu22.1.4-0ubuntu32.1.4-0ubuntu42.1.5-1ubuntu12.1.5-1ubuntu1.12.1.5-1ubuntu1.3 |
None known |
open-iscsiUbuntu:24.04:LTS |
All versions, plus listed versions 2.1.8-1ubuntu22.1.9-3ubuntu12.1.9-3ubuntu22.1.9-3ubuntu32.1.9-3ubuntu4 Show 5 moreShow less2.1.9-3ubuntu5.12.1.9-3ubuntu5.22.1.9-3ubuntu5.32.1.9-3ubuntu5.42.1.9-3ubuntu5.5 |
None known |
open-iscsiUbuntu:26.10 |
All versions, plus listed versions 2.1.11-3ubuntu32.1.11-5ubuntu12.1.11-5ubuntu42.1.11-5ubuntu52.1.11-5ubuntu6 |
None known |
open-iscsiUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.11-1ubuntu32.1.11-3ubuntu12.1.11-3ubuntu22.1.11-3ubuntu32.1.11-3ubuntu3.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115484 is a high vulnerability (CVSS 7.6) in Red Hat Enterprise Linux 10, published October 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.