---
id: CVE-2026-115484
title: >-
  open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in
  iscsiuio parse_msg (CVE-2026-115484)
summary: >-
  A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option
  parser incorrectly calculates the length of the options data, causing it to
  read beyond the allocated buffer into adjacent heap memory. An attacker on the
  same net…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-20'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T01:39:05+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115484'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2556265'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115484'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115484'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-23T01:11:52.506Z'
---

## Overview

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json)

**open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Enterprise Linux 6

## Remediation

Affected

Workarounds / mitigations:

- Restrict untrusted systems from the L2 broadcast domain where iscsiuio-managed interfaces operate. If IPv4 DHCP is not required for iSCSI boot, configure static IP addressing. Where DHCP must remain enabled, limit DHCP/BOOTP traffic so only trusted infrastructure can reach the affected host.