Mitigation Strategies

The immediate mitigation step is to update dhcpcd to a version that includes the fix from commit 2f00c7b, which addresses the one-byte stack out-of-bounds write vulnerability.

Until the update can be applied, network administrators should consider restricting or filtering DHCPv6 ADVERTISE messages from untrusted or unauthenticated sources on the local network to prevent exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56114 is a medium-severity vulnerability in dhcpcd versions up to 10.3.2. It is a one-byte stack out-of-bounds write in the dhcp6_makemessage() function. An unauthenticated attacker on the same local network can exploit this by sending a specially crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX with a /0 prefix and an OPTION_PD_EXCLUDE option with an exclude prefix length between /121 and /128. This causes the program to write beyond a fixed local buffer, potentially corrupting adjacent stack memory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to corruption of adjacent stack memory due to an out-of-bounds write. Such memory corruption may cause unexpected behavior, crashes, or potentially allow an attacker to influence program execution. Since the attacker does not need authentication and only requires access to the same local network, this increases the risk of exploitation in local network environments.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring DHCPv6 ADVERTISE messages on the local network for maliciously crafted packets containing an IA_PD IAPREFIX with a /0 prefix and an OPTION_PD_EXCLUDE option with an exclude prefix length between /121 and /128.

Network administrators can use packet capture tools such as tcpdump or Wireshark to filter and analyze DHCPv6 ADVERTISE messages for suspicious OPTION_PD_EXCLUDE values.

• Use tcpdump to capture DHCPv6 ADVERTISE messages: tcpdump -i <interface> 'udp and port 546 and port 547'
• Analyze captured packets in Wireshark, filtering for DHCPv6 ADVERTISE messages and inspecting IA_PD IAPREFIX and OPTION_PD_EXCLUDE options for abnormal prefix lengths (/121 to /128).

Useful 0 Not Useful 0