CVE-2026-115485Medium· 6.3▾ SunlitA flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
iscsi-initiator-utils (all versions)iscsi-initiator-utilsiscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
If DHCPv6 is not required for iscsiuio, disable DHCPv6 handling for the relevant network interface. If DHCPv6 is necessary, restrict network exposure to trusted adjacent networks and implement firewall rules to prevent forged DHCPv6 server traffic from reaching clients on shared L2 segments.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115484High· 7.6Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
CVE-2026-115486High· 7.1Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
CVE-2026-92824Medium· 6.2libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts (CVE-2026-92824)
CVE-2026-114038Medium· 5.1device-mapper-multipath: device-mapper-multipath: Information disclosure via malformed format string (CVE-2026-114038)
CVE-2026-114041Medium· 6.5freerdp: FreeRDP: Windows RD Gateway consent message heap out-of-bounds read (CVE-2026-114041)
CVE-2026-114044Medium· 5.3freerdp: FreeRDP: Android client heap out-of-bounds read via graphics pipeline (CVE-2026-114044)