NetworkConfiguration dhcpcd up to 10.3.2 src/dhcp6.c dhcp6_makemessage out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in NetworkConfiguration dhcpcd up to 10.3.2. Affected by this issue is the function dhcp6_makemessage of the file src/dhcp6.c. This manipulation causes out-of-bounds write. The identification of this vulnerability is CVE-2026-56115. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in NetworkConfiguration dhcpcd up to 10.3.2 and classified as problematic. Affected by this vulnerability is the function dhcp6_makemessage of the file src/dhcp6.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.

The weakness was shared by CuB3y0nd as 2f00c7bfc408b6582d331932dfa47829c4819029. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-56115 since 06/18/2026. The exploitation appears to be difficult. Access to the local network is required for this attack to succeed. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading eliminates this vulnerability. Applying the patch 2f00c7bfc408b6582d331932dfa47829c4819029 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• NetworkConfiguration

Name

• dhcpcd

Version

• 10.3.0
• 10.3.1
• 10.3.2

License

• open-source

Website

• Product: https://github.com/NetworkConfiguration/dhcpcd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion