CVE-2026-18727

Received Received - Intake

Integer Underflow in Open-iSCSI iscsiuio DHCPv6 Parsing

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Red Hat, Inc.

Description

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-18727

EUVD

EUVD-2026-57637

Affected Vendors & Products

Vendor	Product	Version / Range
open-iscsi	iscsiuio	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow and out-of-bounds read flaw in open-iscsi's iscsiuio component during DHCPv6 packet parsing. Crafted DHCPv6 Advertise traffic with a short UDP length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can send specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

Detection Guidance

Detecting this vulnerability requires monitoring for DHCPv6 Advertise traffic with unusually short UDP lengths. Use network sniffing tools like tcpdump or Wireshark to capture and analyze DHCPv6 packets. Look for malformed packets where the UDP length is shorter than expected. Example command: tcpdump -i any -vv udp port 546 or 547. Check iscsiuio logs for crashes or errors during DHCPv6 exchanges.

Impact Analysis

This vulnerability can cause denial of service by crashing the iscsiuio process or disrupting services relying on it. Systems using open-iscsi with iscsiuio for iSCSI over IPv6 may become unresponsive or require a restart. The impact is limited to adjacent network segments where the attacker can send crafted IPv6 UDP traffic.

Mitigation Strategies

Update open-iscsi to the latest version to patch the flaw. Disable DHCPv6 for iSCSI interfaces if not required. Block malformed DHCPv6 traffic at the network perimeter using firewalls or IDS/IPS rules. Restrict IPv6 traffic to trusted sources only. Monitor iscsiuio service for crashes and restart it if needed.

Hi! I’m here to help you understand CVE-2026-18727. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70