CVE-2026-56114 NetworkConfiguration CVE debrief

Who should care

Network administrators and security teams responsible for managing dhcpcd installations should be aware of this vulnerability. The vulnerability allows unauthenticated same-link attackers to potentially corrupt adjacent stack memory, which could lead to a denial of service or potentially allow for code execution. Organizations using dhcpcd versions prior to 10.3.3 should prioritize patching or mitigating this vulnerability.

Technical summary

The dhcp6_makemessage() function in src/dhcp6.c contains a one-byte stack out-of-bounds write vulnerability. This vulnerability is triggered when an oversized RFC6603 OPTION_PD_EXCLUDE option body is serialized. An attacker can send a crafted DHCPv6 ADVERTISE message with an IA_PD IAPREFIX /0 and a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to exploit this vulnerability. The vulnerability has been fixed in commit 2f00c7b. The CVSS vector for this vulnerability is CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

This vulnerability should be prioritized for patching or mitigation due to its potential impact on network security. The vulnerability allows unauthenticated same-link attackers to potentially corrupt adjacent stack memory, which could lead to a denial of service or potentially allow for code execution.

Recommended defensive actions

• Patch dhcpcd installations to version 10.3.3 or later.
• Implement network segmentation to limit the attack surface.
• Monitor network traffic for suspicious DHCPv6 activity.
• Consider implementing compensating controls such as intrusion detection systems.
• Perform regular vulnerability scans and inventory checks.

Evidence notes

The CVE-2026-56114 vulnerability was identified in dhcpcd through 10.3.2. The vulnerability exists in the dhcp6_makemessage() function in src/dhcp6.c. The vulnerability allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. The vulnerability has a CVSS score of 6 and a severity of MEDIUM. The CVE was published on 2026-06-23T17:17:09.163Z and modified on 2026-06-24T15:16:41.957Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.