CVE-2026-4749
Information Disclosure Vulnerability in MiracleCast Before v
Publication date: 2026-03-24
Last updated on: 2026-05-05
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| albfan | miraclecast | to 1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Miraclecast involves unsafe handling of cloned functions in the DHCP component, specifically in the dhcp_get_option function. It can lead to reading invalid DHCP option data, which poses a security risk.
The issue originates from code cloned from the ConnMan project, where a similar vulnerability (CVE-2021-26676) was fixed. Miraclecast applied the same patch to mitigate this problem.
How can this vulnerability impact me? :
The vulnerability allows the DHCP component in Miraclecast to process invalid data, which could lead to potential security issues such as unauthorized data reading or system instability.
According to the CVSS score (6.5), the impact is significant on confidentiality (high), but it does not affect integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability relates to unsafe handling of DHCP option data in the Miraclecast project's DHCP component. Detection would involve monitoring or analyzing DHCP traffic for malformed or invalid DHCP options that could trigger the vulnerability."}, {'type': 'paragraph', 'content': 'Since the issue is in the DHCP service of Miraclecast, which is a proof-of-concept feature, detection could include checking if the vulnerable version of Miraclecast (before v1.0) is running on your system.'}, {'type': 'paragraph', 'content': 'No specific detection commands are provided in the available resources.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the security patch that fixes the unsafe handling of DHCP option data in Miraclecast. This patch corresponds to the fix applied in pull request #555, which backports a fix from the ConnMan project.
If you are running a version of Miraclecast before v1.0, upgrade to a version that includes this patch or apply the patch manually.
Additionally, since the DHCP service is a proof-of-concept feature, consider disabling or not using the DHCP component in Miraclecast until the fix is applied or the feature is externalized.