lldpd up to 1.0.21 lldpd_decode out-of-bounds

Summaryinfo

A vulnerability classified as problematic was found in lldpd up to 1.0.21. This vulnerability affects the function lldpd_decode. Such manipulation leads to out-of-bounds. This vulnerability is documented as CVE-2026-46433. The attack requires being on the local network. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in lldpd up to 1.0.21 and classified as problematic. Affected by this issue is the function lldpd_decode. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-46433 since 05/14/2026. The exploitation is known to be easy. The attack needs to approached within the local network. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.0.22 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• lldpd

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21

License

• open-source

Website

• Product: https://github.com/lldpd/lldpd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion