{"id":"CVE-2026-115484","title":"open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg (CVE-2026-115484)","summary":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same net…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9"],"published":"2026-10-20","updated":"2026-10-23","sourceUpdated":"2026-10-23T01:39:05+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115484"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556265"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115484"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115484"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-23T01:11:52.506Z","slug":"CVE-2026-115484","body":"## Overview\n\nA flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json)\n\n**open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Restrict untrusted systems from the L2 broadcast domain where iscsiuio-managed interfaces operate. If IPv4 DHCP is not required for iSCSI boot, configure static IP addressing. Where DHCP must remain enabled, limit DHCP/BOOTP traffic so only trusted infrastructure can reach the affected host.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}