CVE-2026-115863 ConnMan CVE debrief

Who should care

Network administrators and security teams responsible for managing ConnMan installations should assess exposure and prioritize patching to prevent potential crashes of connmand, which runs as root.

Why it matters

CVE-2026-115863 is a high-severity vulnerability in ConnMan that can be exploited by an on-link attacker to cause an unauthenticated crash of connmand. Network administrators and security teams should assess exposure and prioritize patching to prevent potential disruptions.

• Unauthenticated on-link crash of connmand
• Potential disruption of network connectivity
• Increased risk due to running as root

Technical summary

The vulnerability is caused by a stack-based buffer overflow in get_domains in gdhcp/client.c. The issue occurs when a DHCPv6 DOMAIN_LIST option of >= 1025 non-zero bytes is received, causing the label walk to leave the buffer and read/write '.' past its end in attacker-chosen strides. This can be triggered by an on-link attacker without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is an unauthenticated on-link crash of connmand, which runs as root.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from the vendor once available
• Monitor network traffic for suspicious DHCPv6 REPLY messages
• Restrict access to connmand to minimize potential impact
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was introduced in bb06c47 and is caused by a stack-based buffer overflow in get_domains in gdhcp/client.c. The issue occurs when a DHCPv6 DOMAIN_LIST option of >= 1025 non-zero bytes is received, causing the label walk to leave the buffer and read/write '.' past its end in attacker-chosen strides.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.