{"id":"CVE-2026-115485","title":"Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio","summary":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"iscsi-initiator-utils","affected":["iscsi-initiator-utils (all versions)","iscsi-initiator-utils","iscsi-initiator-utils (all versions)","iscsi-initiator-utils (all versions)","iscsi-initiator-utils (all versions)"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:16:30.006Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115485","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-115485"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556266","label":"RHBZ#2556266"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T01:11:52.507Z","slug":"CVE-2026-115485","body":"## Overview\n\nA flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.\n\n## Affected\n\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils`\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nIf DHCPv6 is not required for iscsiuio, disable DHCPv6 handling for the relevant network interface. If DHCPv6 is necessary, restrict network exposure to trusted adjacent networks and implement firewall rules to prevent forged DHCPv6 server traffic from reaching clients on shared L2 segments.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}