CVE-2026-56114

Name	CVE-2026-56114
Description	dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140767

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dhcpcd (PTS)	trixie	1:10.1.0-11+deb13u3	fixed
	forky, sid	1:10.3.2-4	fixed
dhcpcd5 (PTS)	bullseye	7.1.0-2	vulnerable
	bookworm	9.4.1-24~deb12u5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
dhcpcd	source	trixie	1:10.1.0-11+deb13u3
dhcpcd	source	(unstable)	1:10.3.2-4	1140767
dhcpcd5	source	bookworm	9.4.1-24~deb12u5
dhcpcd5	source	(unstable)	(unfixed)

Notes

[bullseye] - dhcpcd5 <postponed> (Minor issue; needs non-default IA_PD config + adjacent DHCPv6 server; 1-byte OOB, availability-only)
Fixed by: https://github.com/NetworkConfiguration/dhcpcd/commit/2f00c7bfc408b6582d331932dfa47829c4819029