CVE-2026-115485
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
CVE-2026-115485- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-108556
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
EUVD-2026-108556- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-37x9-3cr5-w6m4
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen()...
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
GHSA-37x9-3cr5-w6m4- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
CVE-2026-115485- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-115485
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
DEBIAN-CVE-2026-115485- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-115485
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
UBUNTU-CVE-2026-115485- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVAZL-111389 No score
CVE-2026-115485 affecting package iscsi-initiator-utils 2.1.12-1
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- Record
AZL-111389- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iscsi-initiator-utilsAzure Linux:3 |
through 2.1.12-1 | None known |
open-iscsiDebian:12 |
All versions, plus listed versions 2.1.10-12.1.10-22.1.10-32.1.11-12.1.11-2 Show 14 moreShow less2.1.11-32.1.11-42.1.11-52.1.11-62.1.12-12.1.12-22.1.13-12.1.8-12.1.8-1+deb12u12.1.8-22.1.9-12.1.9-22.1.9-32.1.9-4 |
None known |
open-iscsiDebian:13 |
All versions, plus listed versions 2.1.11-12.1.11-1+deb13u12.1.11-1+deb13u22.1.11-22.1.11-3 Show 6 moreShow less2.1.11-42.1.11-52.1.11-62.1.12-12.1.12-22.1.13-1 |
None known |
open-iscsiDebian:14 |
All versions, plus listed versions 2.1.11-12.1.11-22.1.11-32.1.11-42.1.11-5 Show 4 moreShow less2.1.11-62.1.12-12.1.12-22.1.13-1 |
None known |
open-iscsiUbuntu:14.04:LTS |
All versions, plus listed versions 2.0.873-3ubuntu72.0.873-3ubuntu82.0.873-3ubuntu9 |
None known |
open-iscsiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.0.873-3ubuntu132.0.873+git0.3b4b4500-13ubuntu32.0.873+git0.3b4b4500-14ubuntu12.0.873+git0.3b4b4500-14ubuntu32.0.873+git0.3b4b4500-14ubuntu3.1 Show 7 moreShow less2.0.873+git0.3b4b4500-14ubuntu3.22.0.873+git0.3b4b4500-14ubuntu3.32.0.873+git0.3b4b4500-14ubuntu3.42.0.873+git0.3b4b4500-14ubuntu3.52.0.873+git0.3b4b4500-14ubuntu3.62.0.873+git0.3b4b4500-14ubuntu3.72.0.873+git0.3b4b4500-14ubuntu3.7+esm1 |
None known |
open-iscsiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.0.874-4ubuntu32.0.874-4ubuntu42.0.874-4ubuntu52.0.874-5ubuntu12.0.874-5ubuntu2 Show 10 moreShow less2.0.874-5ubuntu2.12.0.874-5ubuntu2.22.0.874-5ubuntu2.32.0.874-5ubuntu2.42.0.874-5ubuntu2.62.0.874-5ubuntu2.72.0.874-5ubuntu2.92.0.874-5ubuntu2.102.0.874-5ubuntu2.112.0.874-5ubuntu2.11+esm1 |
None known |
open-iscsiUbuntu:20.04:LTS |
All versions, plus listed versions 2.0.874-7.1ubuntu32.0.874-7.1ubuntu52.0.874-7.1ubuntu62.0.874-7.1ubuntu6.12.0.874-7.1ubuntu6.22.0.874-7.1ubuntu6.32.0.874-7.1ubuntu6.42.0.874-7.1ubuntu6.5 |
None known |
open-iscsiUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.4-0ubuntu12.1.4-0ubuntu22.1.4-0ubuntu32.1.4-0ubuntu42.1.5-1ubuntu12.1.5-1ubuntu1.12.1.5-1ubuntu1.3 |
None known |
open-iscsiUbuntu:24.04:LTS |
All versions, plus listed versions 2.1.8-1ubuntu22.1.9-3ubuntu12.1.9-3ubuntu22.1.9-3ubuntu32.1.9-3ubuntu4 Show 5 moreShow less2.1.9-3ubuntu5.12.1.9-3ubuntu5.22.1.9-3ubuntu5.32.1.9-3ubuntu5.42.1.9-3ubuntu5.5 |
None known |
open-iscsiUbuntu:26.10 |
All versions, plus listed versions 2.1.11-3ubuntu32.1.11-5ubuntu12.1.11-5ubuntu42.1.11-5ubuntu52.1.11-5ubuntu6 |
None known |
open-iscsiUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.11-1ubuntu32.1.11-3ubuntu12.1.11-3ubuntu22.1.11-3ubuntu32.1.11-3ubuntu3.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115485 is a medium vulnerability (CVSS 6.3) in Red Hat Enterprise Linux 10, published October 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. No source names a fixed version.