CVE-2026-115680 in MDK-Middleware
Summary
by MITRE • 10/26/2026
Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0 represents a critical class of memory safety issues within the DHCPv6 protocol implementation, specifically affecting devices that rely on this middleware for network configuration and communication. This flaw encompasses two distinct but related technical failures: an over-read condition triggered by malformed or maliciously crafted DHCPv6 options, and an unintended data retransmission mechanism that can lead to resource exhaustion or state confusion in the networking stack. These issues stem from insufficient validation of input parameters and a lack of robust boundary checks when processing variable-length option fields within DHCPv6 packets, which are commonly used for dynamic address assignment and configuration delivery in IPv6 networks.
From a technical perspective, the over-read vulnerability arises because the middleware does not adequately verify that the length field specified in a DHCPv6 option corresponds to actual available data before attempting to read or process it. When an attacker sends a specially crafted packet with an oversized option length value, the application may attempt to access memory locations beyond the allocated buffer boundaries. This behavior aligns directly with CWE-125, Out-of-bounds Read, and potentially CWE-787, Out-of-bounds Write if subsequent processing logic attempts to utilize corrupted data pointers. The consequence of such an over-read can range from information disclosure, where sensitive memory contents are leaked back through error responses or logs, to application crashes that result in denial of service conditions. In embedded systems managed by Keil MDK, which often operate with limited resources and strict real-time constraints, a crash in the network stack can have cascading effects on system stability and availability.
The second aspect of this vulnerability involves unintended data retransmission, which is indicative of poor state management within the DHCPv6 client or server logic. Under normal operation, DHCP messages are acknowledged to ensure reliable delivery; however, flaws in how acknowledgments are tracked or how timeouts are handled can cause the system to resend packets unnecessarily. This behavior maps closely to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization of Accesses, if race conditions are involved, or more broadly to logic errors described under CWE-841, Improper Enforcement of Behavioral Workflow. The unintended retransmission can lead to network congestion, increased latency for other devices on the subnet, and potential amplification effects in distributed denial-of-service scenarios. Furthermore, it may allow an attacker to disrupt the DHCPv6 lease renewal process, effectively preventing legitimate clients from maintaining their IP configurations or obtaining new ones.
In terms of operational impact, these vulnerabilities pose a significant risk to any IoT device, industrial control system, or network infrastructure component utilizing Arm Keil MDK-Middleware for connectivity. An adversary could exploit the over-read condition to gather internal state information that aids in further exploitation attempts, such as identifying kernel versions or security patches installed on the target. Alternatively, they could trigger a denial of service by causing the DHCPv6 process to crash repeatedly, thereby isolating the device from the network. The retransmission flaw allows for traffic manipulation and potential disruption of automated provisioning systems that rely on timely and accurate DHCP exchanges. Given that DHCP is often one of the first protocols engaged when a device joins a network, these weaknesses represent an attractive attack surface for initial access or persistent denial-of-service campaigns against embedded networks.
Mitigation strategies must focus primarily on updating to patched versions of Arm Keil MDK-Middleware where these boundary checks and state management logic have been corrected by the vendor. For organizations unable to immediately update their middleware stack, defensive coding practices should be implemented in custom wrappers around DHCPv6 functions to validate option lengths strictly before processing. Network-level mitigations include deploying intrusion detection systems configured with signatures for anomalous DHCPv6 traffic patterns, such as unusually large options or rapid retransmission sequences. Additionally, isolating critical devices on separate VLANs and restricting access to the management plane can limit the blast radius of any successful exploitation attempt. Security teams should also review their deployment configurations to ensure that unnecessary network services are disabled if not required by the application logic, thereby reducing the overall attack surface exposed to potential threats.