CVE-2026-71402

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in wicked DHCPv4 Client

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: SUSE

Description

An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-71402

EUVD

EUVD-2026-67080

Affected Vendors & Products

Vendor	Product	Version / Range
wicked	wicked	to 0.6.80 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in the DHCPv4 packet capture code of wicked. The function ni_capture_inspect_udp_header() incorrectly uses the IP total length as the payload length instead of the remaining UDP payload length. This causes the DHCP option walker in the DHCPv4 client to read up to 68 bytes past the end of a 1500-byte packet buffer. An attacker on the same network could send a crafted DHCP/UDP packet to make the client parse adjacent heap memory as DHCP options, potentially exposing allocator metadata or pointer values.

Detection Guidance

Monitor network traffic for malformed DHCP/UDP packets using tools like tcpdump or Wireshark. Look for packets with unusual IP total length or UDP payload sizes. Check wicked logs for crashes or errors related to packet parsing. Ensure packet capture buffers are not exceeding expected sizes.

Impact Analysis

An attacker on the same local network could exploit this to read sensitive memory contents adjacent to the packet buffer. This may expose internal data like memory allocator metadata or pointers, but does not allow memory writes, direct control over leaked data, or remote code execution. The impact is limited to information disclosure within the client's memory space.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized data access, exfiltration, or modification of sensitive information. The issue is limited to a bounded out-of-bounds read in DHCPv4 packet handling, which could expose heap metadata but does not provide a mechanism for data breaches or unauthorized access to personal or health data.

Mitigation Strategies

Update wicked to version 0.6.81 or later to apply the patch. If updating is not immediately possible, restrict network access to trusted sources or isolate systems running vulnerable versions. Monitor for suspicious DHCP traffic and disable DHCP client services if not required.

Hi! I’m here to help you understand CVE-2026-71402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70