Every CVE Search/ Get API key

CVE-2026-46433

lldpd: Heap OOB Read in VLAN Decapsulation memmove

6.5 MediumFix available

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.22%Up 0.2 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

lldpd: Heap OOB Read in VLAN Decapsulation memmove

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
CVE-2026-46433
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-35858 6.5

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
EUVD-2026-35858
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 6.5

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
CVE-2026-46433
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2026-46433 6.5

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
ALPINE-CVE-2026-46433
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 6.5

lldpd: Heap OOB Read in VLAN Decapsulation memmove

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
CVE-2026-46433
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-46433 6.5

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
DEBIAN-CVE-2026-46433
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2026-46433 6.5

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
UBUNTU-CVE-2026-46433
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-89700 No score

CVE-2026-46433 affecting package lldpd for versions less than 1.0.22-1

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Record
AZL-89700
Updated
2026-11-02
OSVCLSA-2026-1781628379 No score

lldpd: Fix of CVE-2026-46433

  • CVE-2026-46433: fix heap out-of-bounds read in VLAN decapsulation memmove
Record
CLSA-2026-1781628379
Updated
2026-11-02
OSVCLSA-2026-1782221091 No score

lldpd: Fix of CVE-2026-46433

  • CVE-2026-46433: fix heap out-of-bounds read in lldpd_decode when stripping VLAN tag
Record
CLSA-2026-1782221091
Updated
2026-11-02
OSVopenSUSE-SU-2026:10794-1 No score

liblldpctl4-1.0.22-1.1 on GA media

These are all security issues fixed in the liblldpctl4-1.0.22-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10794-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21146-1 No score

Security update for lldpd

This update for lldpd fixes the following issues:

Changes in lldpd:

  • Update to version 1.0.22

    • Fix CVE-2026-46433, out-of-bound read access when removing VLAN tag (#787).
    • Reject 0-length management address in LLDP.
    • Fix race condition when creating the control socket.
    • Fix FDP MAC address.
    • Fix memory leak in the BSD bridge query path.
    • Fix duplicate management addresses when merging EDP VLAN frames.

  • Update to version 1.0.21 Changes:

    • Add "configure lldp portdescription-source" to choose how to populate port description. Fix:
    • Fix path traversal vulnerabilities in the privileged process.
    • Fix arbitrary file deletion in the privileged process.
    • Fix accuracy of Dot3 MAU types advertised and add support for 200G and 400G.
    • Fix detection of wireless interfaces.

  • Update to version 1.0.20 Changes:

    • Enable fast start unconditionally (and move its configuration in "configure lldp").
    • Make VLAN advertisements configurable. Fix:
    • Do not break zero-copy traffic on Linux.
    • Fix crash on rapid addition/removal of interfaces.
    • Fix management address selection when pattern is a negative IP address.

  • Update to version 1.0.19 Changes:

    • Add cvlan/svlan/tpmr capabilities.
    • Add lldpctl_watch_sync_unblock to liblldpctl.
    • Add C++ wrapper for lldpctl. Fix:
    • Fix AppArmor policy for /run/lldpd/lldpd.socket.lock.
    • Do not query stats for a down interface on Linux.
Record
openSUSE-SU-2026:21146-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lldpd
Alpine:v3.23
 before 1.0.22-r0
1.0.22-r0
lldpd
Alpine:v3.24
 before 1.0.22-r0
1.0.22-r0
lldpd
Azure Linux:3
 before 1.0.22-1
1.0.22-1
lldpd
TuxCare:AlmaLinux:9.2
 before 1.0.4-10.el9.tuxcare.els4
1.0.4-10.el9.tuxcare.els4
lldpd-devel
TuxCare:AlmaLinux:9.2
 before 1.0.4-10.el9.tuxcare.els4
1.0.4-10.el9.tuxcare.els4
lldpd
TuxCare:AlmaLinux:9.6
 before 1.0.18-6.el9.tuxcare.els1
1.0.18-6.el9.tuxcare.els1
lldpd-devel
TuxCare:AlmaLinux:9.6
 before 1.0.18-6.el9.tuxcare.els1
1.0.18-6.el9.tuxcare.els1
lldpd
Debian:12
 All versions, plus listed versions
1.0.16-11.0.16-1+deb12u11.0.17-11.0.18-11.0.19-11.0.21-11.0.22-1
 None known
lldpd
Debian:13
 All versions, plus listed versions
1.0.18-11.0.19-11.0.21-11.0.22-1
 None known
lldpd
Debian:14
 before 1.0.22-1, plus listed versions
1.0.18-11.0.19-11.0.21-1
1.0.22-1
Show 18 moreShow less
Affected packages
PackageAffectedFixed
openvswitch
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.0-0ubuntu42.4.0-0ubuntu52.5.0~git20160129.46a88d9-0ubuntu12.5.0~git20160219.522aca6-0ubuntu12.5.0~git20160219.522aca6-0ubuntu2
Show 11 moreShow less
2.5.0~git20160219.522aca6-0ubuntu32.5.0-0ubuntu12.5.2-0ubuntu0.16.04.12.5.2-0ubuntu0.16.04.22.5.2-0ubuntu0.16.04.32.5.4-0ubuntu0.16.04.12.5.5-0ubuntu0.16.04.12.5.5-0ubuntu0.16.04.22.5.9-0ubuntu0.16.04.22.5.9-0ubuntu0.16.04.32.5.9-0ubuntu0.16.04.3+esm1
 None known
lldpd
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.7.16-10.7.19-1
 None known
openvswitch
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.0-0ubuntu22.8.1-0ubuntu22.8.1-0ubuntu32.9.0~git20180205.5a39582ca-0ubuntu12.9.0-0ubuntu1
Show 9 moreShow less
2.9.2-0ubuntu0.18.04.22.9.2-0ubuntu0.18.04.32.9.5-0ubuntu0.18.04.12.9.7-0ubuntu0.18.04.22.9.8-0ubuntu0.18.04.22.9.8-0ubuntu0.18.04.32.9.8-0ubuntu0.18.04.42.9.8-0ubuntu0.18.04.52.9.8-0ubuntu0.18.04.5+esm1
 None known
lldpd
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.9.8-10.9.9-10.9.9-1ubuntu0.1
 None known
openvswitch
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.12.0-0ubuntu12.12.0-0ubuntu22.12.1~git20191107.7accd1302-0ubuntu12.12.90~git20200107.af683565b-0ubuntu12.12.90~git20200107.af683565b-0ubuntu2
Show 16 moreShow less
2.12.90~git20200107.af683565b-0ubuntu32.13.0~git20200127.dbdf66c29-0ubuntu22.13.0~git20200212.15ae9db33-0ubuntu12.13.0~git20200212.15ae9db33-0ubuntu22.13.0-0ubuntu12.13.1-0ubuntu0.20.04.12.13.1-0ubuntu0.20.04.32.13.1-0ubuntu0.20.04.42.13.3-0ubuntu0.20.04.12.13.3-0ubuntu0.20.04.22.13.5-0ubuntu12.13.8-0ubuntu12.13.8-0ubuntu1.12.13.8-0ubuntu1.22.13.8-0ubuntu1.32.13.8-0ubuntu1.4
 None known
lldpd
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.0.4-11.0.4-1build11.0.4-1build2
 None known
lldpd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.0.11-11.0.12-11.0.13-1
 None known
openvswitch
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.16.0-0ubuntu22.16.0-0ubuntu32.16.0-0ubuntu42.17.0~git20220105.0d1ffb7-0ubuntu12.17.0~git20220118.1b9fd88-0ubuntu1
Show 12 moreShow less
2.17.0~git20220121.109d024-0ubuntu12.17.0-0ubuntu12.17.2-0ubuntu0.22.04.12.17.2-0ubuntu0.22.04.22.17.3-0ubuntu0.22.04.12.17.3-0ubuntu0.22.04.22.17.5-0ubuntu0.22.04.22.17.7-0ubuntu0.22.04.12.17.8-0ubuntu0.22.04.12.17.9-0ubuntu0.22.04.12.17.9-0ubuntu0.22.04.22.17.12-0ubuntu0.22.04.1
 None known
lldpd
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.0.17-11.0.18-11.0.18-1build11.0.18-1build31.0.18-1ubuntu0.1
 None known
openvswitch
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.0-13.2.0-23.2.0-2build13.2.2~git20231029-23.2.2~git20231029-2build1
Show 11 moreShow less
3.3.0~git20240118.e802fe7-23.3.0~git20240118.e802fe7-33.3.0-13.3.0-1build13.3.0-1ubuntu13.3.0-1ubuntu33.3.0-1ubuntu3.13.3.0-1ubuntu3.23.3.4-0ubuntu0.24.04.13.3.4-0ubuntu0.24.04.23.3.9-0ubuntu0.24.04.1
 None known
lldpd
Ubuntu:25.10
 All versions, plus listed versions
1.0.18-1build31.0.18-1build4
 None known
openvswitch
Ubuntu:25.10
 All versions, plus listed versions
3.5.0-1build13.5.1-0ubuntu13.6.0-13.6.0-23.6.0-2ubuntu0.1
 None known
lldpd
Ubuntu:26.10
 All versions, plus listed versions
1.0.19-11.0.22-11.0.22-1build1
 None known
openvswitch
Ubuntu:26.10
 All versions, plus listed versions
3.7.1-23.7.1-33.7.1-3build14.0.0-1
 None known
lldpd
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.0.18-1build41.0.19-11.0.19-1ubuntu0.1
 None known
openvswitch
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.0-23.6.0-2build13.6.0-53.6.0-63.6.0-6build1
Show 6 moreShow less
3.6.0-6ubuntu23.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0-13.7.0-1build13.7.1-13.7.1-2
 None known
lldpd
openSUSE:Tumbleweed
 before 1.0.22-1.1
1.0.22-1.1
lldpd
openSUSE:Leap 16.0
 before 1.0.22-bp160.1.1
1.0.22-bp160.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-46433 is a medium vulnerability (CVSS 6.5) in Lldpd, published May 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in lldpd 1.0.22-r0.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open