CVE-2026-56114: dhcpcd DHCPv6 Stack Overflow – Patch Guidance

Technical summary

CVE-2026-56114 is a one-byte stack buffer overflow (CWE-787) in the dhcp6_makemessage() function within src/dhcp6.c. The vulnerability arises from improper validation of the OPTION_PD_EXCLUDE option body defined in RFC 6603. When processing an IA_PD (Identity Association for Prefix Delegation) with an IAPREFIX /0 and an OPTION_PD_EXCLUDE using an exclude prefix length between /121 and /128, the function writes one byte beyond its fixed local buffer boundary. This occurs during serialization of the option data. The attack requires network-layer adjacency and does not require authentication, but the attacker must be able to transmit DHCPv6 ADVERTISE messages that the target will process—a capability available to other hosts on the same link segment.

Business impact

Organizations relying on dhcpcd for IPv6 DHCP client functionality face a denial-of-service risk in environments where untrusted or compromised devices share the same network link. In enterprise deployments using prefix delegation for IPv6 address management, a rogue or compromised router could exploit this to disrupt DHCP services on affected clients. The impact is limited to availability; confidentiality and integrity are not affected. For most organizations, the practical risk depends on network segmentation and trust assumptions about who can send DHCPv6 messages on internal networks.

Affected systems

dhcpcd project's dhcpcd application through version 10.3.2 is affected. The vulnerability was fixed in commit 2f00c7b. Systems running older versions on networks where IPv6 and DHCPv6 are in use—particularly those using prefix delegation—are at risk. Linux distributions and other Unix-like systems that bundle dhcpcd as their default DHCP client are potential vectors; administrators should verify which version their distribution currently ships and whether it has received the patch.

Exploitability

The vulnerability requires same-link network access and the ability to send DHCPv6 ADVERTISE messages. It does not require authentication, user interaction, or special privileges from the attacker. However, exploitability is somewhat constrained by the network requirement (AV:A in the CVSS vector) and the specific crafting required (AC:H reflects the need to engineer the exact option payload). In shared network environments, competing DHCP servers, or scenarios with rogue router advertisements, exploitation becomes more feasible. The one-byte write limits the practical scope of memory corruption but is sufficient to trigger a crash or memory corruption condition.

Remediation

Patch dhcpcd to a version incorporating commit 2f00c7b or later. Verify the fixed version through your distribution's security advisory or the official dhcpcd project repository. Temporary mitigation for environments unable to patch immediately includes network segmentation to restrict which devices can send DHCPv6 messages, disabling IPv6 if not required, or disabling prefix delegation if not actively used. Monitor for unexpected crashes or restarts of the dhcpcd process, as this may indicate exploitation attempts.

Patch guidance

Verify the version of dhcpcd installed on affected systems using 'dhcpcd --version' or checking package management systems (apt, yum, pacman, etc.). Cross-reference the installed version against your distribution's security advisories to confirm whether the patch (commit 2f00c7b or later) is included. If running dhcpcd 10.3.2 or earlier, prioritize updates. Test patches in a non-production environment first, particularly in systems relying on DHCPv6 prefix delegation or other advanced IPv6 configurations, to ensure no regression in functionality.

Detection guidance

Monitor system logs for unexpected dhcpcd crashes, segmentation faults, or restarts coinciding with DHCPv6 ADVERTISE messages. Network monitoring tools can flag DHCPv6 ADVERTISE packets with malformed OPTION_PD_EXCLUDE options (prefix length /121–/128 in IA_PD /0 contexts), though this requires deep packet inspection and knowledge of legitimate DHCPv6 traffic patterns. Enable verbose logging in dhcpcd if available to detect processing anomalies. Detection is inherently difficult without purpose-built IDS signatures; emphasis should be on preventive patching and network access controls.

Why prioritize this

While the CVSS score of 5.3 (MEDIUM) reflects limited scope and the one-byte nature of the write, the vulnerability warrants prompt attention because: (1) dhcpcd is a foundational network service on many Unix-like systems; (2) same-link attacks are practical in shared or weakly segmented environments; (3) a crash in the DHCP client can disrupt network connectivity, compounding operational impact; (4) the vulnerability is unauthenticated and requires no user interaction. Prioritize systems in multi-tenant environments, shared networks, or those where IPv6 and prefix delegation are actively used. Patching is straightforward and carries low risk.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-adjacent attack vector (not directly over the Internet), high attack complexity (specific payload engineering required), no privilege requirement, no user interaction, and impact limited to availability (one-byte stack corruption leading to potential crash). The medium severity accounts for the nuanced exploitation requirements but acknowledges that same-link attacks remain practical in many real-world scenarios, particularly in enterprises with VLANs housing untrusted or IoT devices.

Frequently asked questions