Every CVE Search/ Get API key

CVE-2026-44932

indirect remote shell command injection via unsanitized DHCP options in wicked

8.8 HighFix available

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.36%Down 0.1 points since Jun 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

indirect remote shell command injection via unsanitized DHCP options in wicked

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Record
CVE-2026-44932
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2026-37127 8.8

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Record
EUVD-2026-37127
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hc32-vf4h-9cg4 8.8

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79...

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Record
GHSA-hc32-vf4h-9cg4
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 8.8

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Record
CVE-2026-44932
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSV 8.8

indirect remote shell command injection via unsanitized DHCP options in wicked

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Record
CVE-2026-44932
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVopenSUSE-SU-2026:11018-1 No score

wicked-0.6.79-1.1 on GA media

These are all security issues fixed in the wicked-0.6.79-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11018-1
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2026:20949-1 No score

Security update for wicked

This update for wicked fixes the following issues:

Changes in wicked:

  • Update to version 0.6.79
    • Fix an indirect remote shell command injection via unsanitized dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
      • Fix to escape single-quotes in leaseinfo dump output used by the wicked test dhcp4 and wicked test dhcp6 and written to the /run/wicked/leaseinfo.* files, e.g. to pass them to netconfig. A netconfig modify filtered for strict key='value' lines without any escaped quotes and discarded these lines already before.
      • Fix posix-tz-dbname and tz-string option processing checks to permit only valid characters according to RFC4833.
      • Discard string values containing single-quotes in other options.
      • Trigger to regenerate initrd that may contain wicked binaries on updates from wicked versions <= 0.6.78.
Record
openSUSE-SU-2026:20949-1
Updated
2026-11-02
OSVSUSE-SU-2026:2349-1 No score

Security update for wicked

This update for wicked fixes the following issue

  • CVE-2026-44932: indirect remote shell command injection via unsanitized DHCP options (bsc#1265221).

Changes for wicked:

  • Update to version 0.6.79
  • Fix to escape single-quotes in leaseinfo dump output used by the wicked test dhcp4 and wicked test dhcp6 and written to the /run/wicked/leaseinfo.* files, e.g. to pass them to netconfig. A netconfig modify filtered for strict key='value' lines without any escaped quotes and discarded these lines already before.
  • Fix posix-tz-dbname and tz-string option processing checks to permit only valid characters according to RFC4833.
  • Discard string values containing single-quotes in other options.
  • Trigger to regenerate initrd that may contain wicked binaries on updates from wicked versions <= 0.6.78.
Record
SUSE-SU-2026:2349-1
Updated
2026-11-02
OSVSUSE-SU-2026:2350-1 No score

Security update for wicked

This update for wicked fixes the following issues:

  • CVE-2026-44932: Fixed indirect remote shell command injection via unsanitized DHCP options (bsc#1265221).
Record
SUSE-SU-2026:2350-1
Updated
2026-11-02
OSVSUSE-SU-2026:2353-1 No score

Security update for wicked

This update for wicked fixes the following issues:

  • CVE-2026-44932: Fixed indirect remote shell command injection via unsanitized DHCP options (bsc#1265221).
Record
SUSE-SU-2026:2353-1
Updated
2026-11-02
OSVSUSE-SU-2026:2354-1 No score

Security update for wicked

This update for wicked fixes the following issues:

  • CVE-2026-44932: Fixed indirect remote shell command injection via unsanitized DHCP options (bsc#1265221).
Record
SUSE-SU-2026:2354-1
Updated
2026-11-02
OSVSUSE-SU-2026:3840-1 No score

Security update for wicked

This update for wicked fixes the following issues:

Update to version 0.6.79.

  • CVE-2026-44932: indirect remote shell command injection due to insufficient sanitization of DHCP options written to /run/wicked/leaseinfo.* files (bsc#1265221).
  • CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing (bsc#1274627).
  • CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4 capture parsing (bsc#1274627).

Changes for wicked:

  • Version 0.6.79:
    • Fix to escape single-quotes in leaseinfo dump output used by the wicked test dhcp4 and wicked test dhcp6 and written to the /run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
    • Fix posix-tz-dbname and tz-string option processing checks to permit only valid characters according to RFC4833.
    • Discard string values containing single-quotes in other options.
    • Trigger to regenerate initrd that may contain wicked binaries on updates from wicked versions <= 0.6.78.
  • Version 0.6.78:
    • man: small fixes in wireless manpage (gh#opensuse/wicked#1053)
    • rtnetlink: fix RTM_NEWLINK name resolution in debug (gh#opensuse/wicked#1052)
    • Add support for IPVLAN/IPVTAP (jsc#PED-1942, gh#opensuse/wicked#1050, gh#opensuse/wicked#1051)
    • fsm: remove children reference array from worker (gh#opensuse/wicked#1049)
    • ifxml: migrate and generate lower configs/policies (gh#opensuse/wicked#1048)
    • fsm: use refcount and array macros in worker and policy (gh#opensuse/wicked#1047)
    • route: use refcounted array and fix error leaks (gh#opensuse/wicked#1046)
    • utils: add support for refcounted objects in generic array (gh#openSUSE/wicked#1045)
Record
SUSE-SU-2026:3840-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wicked
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 0.6.79-150700.3.3.1
0.6.79-150700.3.3.1
wicked
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 0.6.79-3.56.1
0.6.79-3.56.1
wicked
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 0.6.79-3.56.1
0.6.79-3.56.1
wicked
SUSE:Linux Enterprise Micro 5.5
 before 0.6.79-150500.3.42.1
0.6.79-150500.3.42.1
wicked
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 0.6.79-150500.3.42.1
0.6.79-150500.3.42.1
wicked
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 0.6.79-150500.3.42.1
0.6.79-150500.3.42.1
wicked
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 0.6.79-150500.3.42.1
0.6.79-150500.3.42.1
wicked
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 0.6.79-150500.3.42.1
0.6.79-150500.3.42.1
wicked
SUSE:Linux Enterprise Micro 5.3
 before 0.6.79-150400.3.39.1
0.6.79-150400.3.39.1
wicked
SUSE:Linux Enterprise Micro 5.4
 before 0.6.79-150400.3.39.1
0.6.79-150400.3.39.1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
wicked
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 0.6.79-150400.3.39.1
0.6.79-150400.3.39.1
wicked
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 0.6.79-150400.3.39.1
0.6.79-150400.3.39.1
wicked
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 0.6.79-150400.3.39.1
0.6.79-150400.3.39.1
wicked
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 0.6.79-150400.3.39.1
0.6.79-150400.3.39.1
wicked
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 3 CVEs
 before 0.6.79-150600.11.20.1
0.6.79-150600.11.20.1
wicked
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 3 CVEs
 before 0.6.79-150600.11.20.1
0.6.79-150600.11.20.1
wicked
openSUSE:Tumbleweed
 before 0.6.79-1.1
0.6.79-1.1
wicked
openSUSE:Leap 16.0
 before 0.6.79-bp160.1.1
0.6.79-bp160.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44932 is a high vulnerability (CVSS 8.8) in Suse Wicked, published June 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in wicked 0.6.79-150700.3.3.1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open