Every CVE Search/ Get API key

CVE-2025-70102

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing...

6.3 MediumFix available

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.18%Unchanged since Jun 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Record
CVE-2025-70102
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2025-210156 6.3

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Record
EUVD-2025-210156
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-9g28-83m6-mvg3 6.3

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing...

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Record
GHSA-9g28-83m6-mvg3
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-476
Updated
2026-11-02
NVD 6.3

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Record
CVE-2025-70102
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2025-70102 6.3

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Record
DEBIAN-CVE-2025-70102
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-70102 6.3

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Record
UBUNTU-CVE-2025-70102
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:21220-1 No score

Security update for dhcpcd

This update for dhcpcd fixes the following issue

Update to 10.3.2:

  • CVE-2025-70102: NULL pointer dereference in parse_option() when processing a specially crafted configuration input (bsc#1268761).

Changes for dhcpcd:

  • options: Ensure ldop is not NULL dereferenced
  • DHCP: Don't run double EXPIRE hooks on carrier loss
  • DHCP: free the state when dropping on state NONE
  • BSD: don't send uninitialised memory using ps_root_indirectioctl
  • Fix fallback_time option
  • IPv4: Ignore DHCP state when building routes
  • route: Routes may not have an interface assinged
  • options: Ensure that an overly long bitflag string does not crash
  • options: Don't assume vsio options have an argument
  • common: Cast via uintptr_t rather than unsigned long in UNCONST
  • privsep: Ensure we recv for real after a successful recv MSG_PEEK
  • DHCP: Add parentheses to macro definitions
  • ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping
  • privsep: enforce message boundaries with MSG_EOR on our messages
  • Protocols will notify when dhcpcd can exit
  • DHCP: Don't request T1 and T2
  • DHCP: Don't request a lease time
  • DHCP6: Don't exit if using DHCP4 INFORM in non manager mode
  • ND: Route Information Option prefix is optional
  • ipv6: respect slaac hwaddr to really use the hwaddr
  • When stopping all interfaces at exit and releasing, remove persistance
  • NetBSD: Delete RTF_CONNECTED route when changing it
  • privsep: Drain the log when the root process is exiting
  • eloop: vastly reworked, kqueue and epoll support on by default
Record
openSUSE-SU-2026:21220-1
Updated
2026-11-02
OSVSUSE-SU-2026:22542-1 No score

Security update for dhcpcd

This update for dhcpcd fixes the following issue

Update to 10.3.2:

  • CVE-2025-70102: NULL pointer dereference in parse_option() when processing a specially crafted configuration input (bsc#1268761).

Changes for dhcpcd:

  • options: Ensure ldop is not NULL dereferenced
  • DHCP: Don't run double EXPIRE hooks on carrier loss
  • DHCP: free the state when dropping on state NONE
  • BSD: don't send uninitialised memory using ps_root_indirectioctl
  • Fix fallback_time option
  • IPv4: Ignore DHCP state when building routes
  • route: Routes may not have an interface assinged
  • options: Ensure that an overly long bitflag string does not crash
  • options: Don't assume vsio options have an argument
  • common: Cast via uintptr_t rather than unsigned long in UNCONST
  • privsep: Ensure we recv for real after a successful recv MSG_PEEK
  • DHCP: Add parentheses to macro definitions
  • ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping
  • privsep: enforce message boundaries with MSG_EOR on our messages
  • Protocols will notify when dhcpcd can exit
  • DHCP: Don't request T1 and T2
  • DHCP: Don't request a lease time
  • DHCP6: Don't exit if using DHCP4 INFORM in non manager mode
  • ND: Route Information Option prefix is optional
  • ipv6: respect slaac hwaddr to really use the hwaddr
  • When stopping all interfaces at exit and releasing, remove persistance
  • NetBSD: Delete RTF_CONNECTED route when changing it
  • privsep: Drain the log when the root process is exiting
  • eloop: vastly reworked, kqueue and epoll support on by default
Record
SUSE-SU-2026:22542-1
Updated
2026-11-02
OSVSUSE-SU-2026:22561-1 No score

Security update for dhcpcd

This update for dhcpcd fixes the following issue

Update to 10.3.2:

  • CVE-2025-70102: NULL pointer dereference in parse_option() when processing a specially crafted configuration input (bsc#1268761).

Changes for dhcpcd:

  • options: Ensure ldop is not NULL dereferenced
  • DHCP: Don't run double EXPIRE hooks on carrier loss
  • DHCP: free the state when dropping on state NONE
  • BSD: don't send uninitialised memory using ps_root_indirectioctl
  • Fix fallback_time option
  • IPv4: Ignore DHCP state when building routes
  • route: Routes may not have an interface assinged
  • options: Ensure that an overly long bitflag string does not crash
  • options: Don't assume vsio options have an argument
  • common: Cast via uintptr_t rather than unsigned long in UNCONST
  • privsep: Ensure we recv for real after a successful recv MSG_PEEK
  • DHCP: Add parentheses to macro definitions
  • ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping
  • privsep: enforce message boundaries with MSG_EOR on our messages
  • Protocols will notify when dhcpcd can exit
  • DHCP: Don't request T1 and T2
  • DHCP: Don't request a lease time
  • DHCP6: Don't exit if using DHCP4 INFORM in non manager mode
  • ND: Route Information Option prefix is optional
  • ipv6: respect slaac hwaddr to really use the hwaddr
  • When stopping all interfaces at exit and releasing, remove persistance
  • NetBSD: Delete RTF_CONNECTED route when changing it
  • privsep: Drain the log when the root process is exiting
  • eloop: vastly reworked, kqueue and epoll support on by default
Record
SUSE-SU-2026:22561-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
dhcpcd
Debian:13
 before 1:10.1.0-11+deb13u3, plus listed versions
1:10.1.0-111:10.1.0-11+deb13u11:10.1.0-11+deb13u2
1:10.1.0-11+deb13u3
dhcpcd
Debian:14
 before 1:10.3.1-1, plus listed versions
1:10.1.0-111:10.1.0-121:10.2.0-11:10.2.2-11:10.2.2-2
Show 21 moreShow less
1:10.2.2-31:10.2.2-41:10.2.2-51:10.2.2-61:10.2.3-11:10.2.4-11:10.2.4-21:10.2.4-31:10.2.4-41:10.2.4-4~bpo13+11:10.3.0-11:10.3.0-21:10.3.0-2~bpo13+11:10.3.0-31:10.3.0-3~bpo13+11:10.3.0-41:10.3.0-51:10.3.0-61:10.3.0-71:10.3.0-7~bpo13+11:10.3.1-1~bpo13+1
1:10.3.1-1
dhcpcd5
Debian:12
 before 9.4.1-24~deb12u5, plus listed versions
9.4.1-229.4.1-239.4.1-24~deb12u19.4.1-24~deb12u29.4.1-24~deb12u39.4.1-24~deb12u4
9.4.1-24~deb12u5
dhcpcd
SUSE:Linux Micro 6.2
 before 10.3.2-160000.1.2
10.3.2-160000.1.2
dhcpcd
SUSE:Linux Enterprise Server 16.0
 before 10.3.2-160000.1.2
10.3.2-160000.1.2
dhcpcd
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 10.3.2-160000.1.2
10.3.2-160000.1.2
dhcpcd
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:10.0.2-3ubuntu31:10.0.5-11:10.0.5-21:10.0.5-31:10.0.5-4
Show 7 moreShow less
1:10.0.5-51:10.0.6-11:10.0.6-1ubuntu11:10.0.6-1ubuntu21:10.0.6-1ubuntu31:10.0.6-1ubuntu3.11:10.0.6-1ubuntu3.2
 None known
dhcpcd
Ubuntu:25.10
 All versions, plus listed versions
1:10.1.0-81:10.1.0-101:10.1.0-111:10.1.0-121:10.2.4-31:10.2.4-4
 None known
dhcpcd
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:10.2.4-41:10.3.0-21:10.3.0-31:10.3.0-7
 None known
dhcpcd
openSUSE:Leap 16.0
 before 10.3.2-160000.1.2
10.3.2-160000.1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-70102 is a medium vulnerability (CVSS 6.3) in dhcpcd, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in dhcpcd 1:10.1.0-11+deb13u3.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open