---
id: CVE-2026-115485
title: >-
  Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read
  and 1-byte write in iscsiuio
summary: >-
  A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option
  parser calls strlen() on raw network data without ensuring a NUL terminator is
  present, causing it to read past the buffer into heap memory. This can result
  in a…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: iscsi-initiator-utils
affected:
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T00:16:30.006Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115485'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115485'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2556266'
    label: RHBZ#2556266
tags:
  - cve.org
ingestedAt: '2026-10-23T01:11:52.507Z'
---

## Overview

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

## Affected

- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils`
- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

If DHCPv6 is not required for iscsiuio, disable DHCPv6 handling for the relevant network interface. If DHCPv6 is necessary, restrict network exposure to trusted adjacent networks and implement firewall rules to prevent forged DHCPv6 server traffic from reaching clients on shared L2 segments.