CVE-2026-46433: lldpd Heap Buffer Over-Read DoS Vulnerability

Technical summary

In lldpd versions prior to 1.0.22, the lldpd_decode() function in src/daemon/lldpd.c processes incoming Ethernet frames and removes 802.1Q VLAN tags (4-byte headers that identify virtual LANs). The removal is performed using memmove() to shift the remaining frame payload left by 4 bytes. However, the function calculates the byte count argument to memmove() as 's - 2 * ETHER_ADDR_LEN' when it should be 's - 2 * ETHER_ADDR_LEN - 4'. This off-by-4 calculation causes the function to read 4 bytes beyond the bounds of the heap-allocated buffer (sized via malloc(h_mtu)) when a received frame is exactly MTU-sized. This is classified as a CWE-125 out-of-bounds read.

Business impact

The over-read flaw can cause lldpd to crash, disrupting LLDP discovery services on affected network infrastructure. For environments that rely on LLDP for network device discovery, topology mapping, and network management automation, an unstable daemon creates operational risk. Organizations using lldpd for network inventory or topology discovery may experience outages. However, the vulnerability does not provide remote code execution, authentication bypass, or confidentiality breaches, limiting its direct business impact to availability and operational stability.

Affected systems

lldpd versions prior to 1.0.22 are vulnerable. The vulnerability is present on systems running older builds of lldpd. Linux distributions and embedded network devices that ship lldpd should verify their bundled version. Systems running version 1.0.22 or later are not affected.

Exploitability

The flaw requires an attacker on the same network segment (adjacent network) to craft and transmit a malformed Ethernet frame matching the target interface's MTU size. No authentication or user interaction is necessary; the attack is triggered upon frame receipt. The technical bar for exploitation is moderate—an attacker must generate a correctly-sized frame, but this is straightforward with standard network tools. However, practical exploitation is limited to denial-of-service impact (daemon crash), as the over-read does not enable information disclosure or code execution. CVSS 3.1 scores this at 6.5 (MEDIUM) reflecting the adjacency requirement and availability-only impact.

Remediation

Upgrade lldpd to version 1.0.22 or later. The patch corrects the memmove() byte count calculation to properly account for the 4-byte VLAN tag. Users should check their distribution's package repository for updated builds or rebuild from the upstream project.

Patch guidance

Upgrade to lldpd version 1.0.22 or later. Verify the version running on your systems using 'lldpd -v' or equivalent package manager queries. Most Linux distributions should provide 1.0.22+ through their stable repositories. If running lldpd on embedded network devices or custom distributions, consult your vendor's advisory for patched binaries. In environments where immediate patching is not feasible, isolate affected systems or restrict network access from untrusted adjacent networks as a temporary measure.

Detection guidance

Monitor system logs and dmesg output for lldpd crashes or core dumps, which may indicate exploitation attempts. If your monitoring infrastructure captures network traffic, look for oversized or malformed LLDP frames (Ethertype 0x88cc) on interfaces running vulnerable lldpd versions. Most modern network visibility platforms can filter for LLDP traffic; correlate traffic anomalies with daemon restart timestamps. Also monitor for frequent lldpd process restarts via systemd journal or syslog, which could indicate repeated triggering of the flaw.

Why prioritize this

While CVSS 3.1 assigns this a MEDIUM score (6.5), organizations should prioritize patching based on their reliance on lldpd for network operations. For networks where LLDP is critical to topology discovery, automation, or monitoring, service continuity is important. The vulnerability is neither remotely exploitable nor present on public internet-facing systems (it requires adjacency), so it presents lower absolute risk than remote code execution flaws. However, environments with lldpd on critical infrastructure or network management systems should patch promptly to avoid availability disruptions. Less critical deployments can follow standard change windows.

Risk score, explained

CVSS 3.1 assigns 6.5 (MEDIUM) due to: Attack Vector: Adjacent (AV:A) – attacker must be on the same network segment; Attack Complexity: Low (AC:L) – no special conditions required; Privileges Required: None (PR:N) – unauthenticated attack; User Interaction: None (UI:N) – automatic upon frame receipt; Confidentiality: None (C:N) – no data exposure; Integrity: None (I:N) – no data modification; Availability: High (A:H) – crash impacts service availability. The score reflects local-network reachability and availability impact, with no escalation to code execution or broader system compromise.

Frequently asked questions