DragonFly BSD up to 6.4.2 ARP Input sys/netinet/if_ether.c arpintr/in_arpinput ar_hln/ar_pln out-of-bounds

Summaryinfo

A vulnerability, which was classified as problematic, was found in DragonFly BSD up to 6.4.2. Affected by this vulnerability is the function arpintr/in_arpinput of the file sys/netinet/if_ether.c of the component ARP Input Handler. Such manipulation of the argument ar_hln/ar_pln leads to out-of-bounds. This vulnerability is traded as CVE-2026-110912. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in DragonFly BSD up to 6.4.2. Affected by this issue is the function arpintr/in_arpinput of the file sys/netinet/if_ether.c of the component ARP Input Handler. The manipulation of the argument ar_hln/ar_pln with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. CVE summarizes:

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-110912 since 10/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Applying the patch 4bb22ffcf2e9fb44995fbfd9945194afc87fb182 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• DragonFly BSD

Version

• 6.4.0
• 6.4.1
• 6.4.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion