CVE-2026-71401

Awaiting Analysis Awaiting Analysis - Queue

Integer Underflow in Wicked DHCPv4 Client

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: SUSE

Description

An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the header length. An unauthenticated attacker on the same network can thereby trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client (wickedd-dhcp4), which can crash the daemon depending on the process memory layout. No information disclosure has been demonstrated. This issue affects wicked up to and including version 0.6.80.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-71401

EUVD

EUVD-2026-67079

Affected Vendors & Products

Vendor	Product	Version / Range
wicked	wicked	to 0.6.80 (inc)
wicked	wickedd-dhcp4	to 0.6.80 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow in the DHCPv4 packet capture code of wicked. The function ni_capture_inspect_udp_header() does not verify that the IP total length field is at least as large as the IP header length before subtracting the header length. An attacker on the same network can trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client, potentially crashing the daemon depending on memory layout.

Detection Guidance

Monitor for crashes in the wicked DHCPv4 client (wickedd-dhcp4) which may indicate exploitation. Check system logs for segmentation faults or abnormal terminations in the daemon. Use packet capture tools like tcpdump to inspect DHCPv4 traffic for malformed packets where ip_len is smaller than ihl.

Impact Analysis

This vulnerability could cause the wicked DHCPv4 client (wickedd-dhcp4) to crash due to an out-of-bounds read. While no information disclosure has been demonstrated, the crash could disrupt network connectivity for systems relying on DHCPv4 for IP address assignment.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a network-based denial-of-service attack on the wicked DHCPv4 client. GDPR and HIPAA focus on data protection and privacy, while this issue primarily impacts system availability and stability. No evidence of data disclosure or privacy violations is associated with this vulnerability.

Mitigation Strategies

Upgrade wicked to version 0.6.81 or later which includes the fix for the integer underflow. If immediate upgrade is not possible, restrict network access to trusted sources or disable the DHCPv4 client service until patched.

Hi! I’m here to help you understand CVE-2026-71401. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70