CVE-2026-56114
dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
CVE-2026-56114- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-38492
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
EUVD-2026-38492- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8q8g-fjv5-5h56
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write...
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
GHSA-8q8g-fjv5-5h56- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
CVE-2026-56114- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-56114
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
ALPINE-CVE-2026-56114- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-56114
- Record
BELL-CVE-2026-56114- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSV
dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
CVE-2026-56114- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-56114
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
DEBIAN-CVE-2026-56114- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-56114
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
UBUNTU-CVE-2026-56114- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-90216 No score
CVE-2026-56114 affecting package dhcpcd for versions less than 10.0.8-2
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
- Record
AZL-90216- Updated
- 2026-11-02
OSVMGASA-2026-0335 No score
Updated dhcpcd packages fix security vulnerabilities
Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory (CVE: CVE-2026-56114). Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash (CVE: CVE-2026-56116).
- Record
MGASA-2026-0335- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dhcpcdAlpine:v3.23 |
before 10.5.2-r0 | 10.5.2-r0 |
dhcpcdAlpine:v3.24 |
before 10.5.2-r0 | 10.5.2-r0 |
dhcpcdAzure Linux:3 |
before 10.0.8-2 | 10.0.8-2 |
dhcpcdAlpaquita:23 |
9.4.1-r1 up to 9.4.1-r4 | 9.4.1-r4 |
dhcpcdAlpaquita:25 |
10.2.3-r0 up to 10.2.3-r1 | 10.2.3-r1 |
dhcpcdAlpaquita:stream |
9.4.1-r3 up to 10.3.2-r1 | 10.3.2-r1 |
dhcpcdDebian:13 |
before 1:10.1.0-11+deb13u3, plus listed versions 1:10.1.0-111:10.1.0-11+deb13u11:10.1.0-11+deb13u2 |
1:10.1.0-11+deb13u3 |
dhcpcdDebian:14 |
before 1:10.3.2-4, plus listed versions 1:10.1.0-111:10.1.0-121:10.2.0-11:10.2.2-11:10.2.2-2 Show 32 moreShow less1:10.2.2-31:10.2.2-41:10.2.2-51:10.2.2-61:10.2.3-11:10.2.4-11:10.2.4-21:10.2.4-31:10.2.4-41:10.2.4-4~bpo13+11:10.3.0-11:10.3.0-21:10.3.0-2~bpo13+11:10.3.0-31:10.3.0-3~bpo13+11:10.3.0-41:10.3.0-51:10.3.0-61:10.3.0-71:10.3.0-7~bpo13+11:10.3.1-11:10.3.1-1~bpo13+11:10.3.1-21:10.3.1-31:10.3.1-41:10.3.1-51:10.3.1-5~bpo13+11:10.3.2-11:10.3.2-21:10.3.2-31:10.3.2-3~bpo13+11:10.3.2-4~bpo13+1 |
1:10.3.2-4 |
dhcpcd5Debian:12 |
before 9.4.1-24~deb12u5, plus listed versions 9.4.1-229.4.1-239.4.1-24~deb12u19.4.1-24~deb12u29.4.1-24~deb12u39.4.1-24~deb12u4 |
9.4.1-24~deb12u5 |
dhcpcdMageia:10 |
before 10.5.0-1.1.mga10 | 10.5.0-1.1.mga10 |
dhcpcdUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.0.2-3ubuntu31:10.0.5-11:10.0.5-21:10.0.5-31:10.0.5-4 Show 7 moreShow less1:10.0.5-51:10.0.6-11:10.0.6-1ubuntu11:10.0.6-1ubuntu21:10.0.6-1ubuntu31:10.0.6-1ubuntu3.11:10.0.6-1ubuntu3.2 |
None known |
dhcpcdUbuntu:25.10 |
All versions, plus listed versions 1:10.1.0-81:10.1.0-101:10.1.0-111:10.1.0-121:10.2.4-31:10.2.4-4 |
None known |
dhcpcdUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.2.4-41:10.3.0-21:10.3.0-31:10.3.0-7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-56114 is a medium vulnerability (CVSS 6.0) in Dhcpcd Project Dhcpcd, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in dhcpcd 10.5.2-r0.
References
github.com/NetworkConfiguration/dhcpcd/commit/2f00c7bfc408b6582d331932dfa47829c4819029
vulncheck.com/advisories/dhcpcd-stack-out-of-bounds-write-in-dhcp6-makemessage
nvd.nist.gov/vuln/detail/CVE-2026-56114
security.alpinelinux.org/vuln/CVE-2026-56114
docs.bell-sw.com/security/cves/CVE-2026-56114
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2026-56114
advisories.mageia.org/MGASA-2026-0335.html
bugs.mageia.org/show_bug.cgi?id=36063
ubuntu.com/security/CVE-2026-56114
cve.org/CVERecord?id=CVE-2026-56114