CVE-2026-115486High· 7.1▾ TwilightA flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated uncond…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
iscsi-initiator-utils (all versions)iscsi-initiator-utilsiscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Keep iscsiuio-managed interfaces on trusted L2 segments only. Where operationally acceptable, filter ICMPv6 Neighbor Advertisement (type 136) and Neighbor Solicitation (type 135) messages from untrusted sources using firewall rules.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115485Medium· 6.3Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
CVE-2026-115484High· 7.6Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
CVE-2026-92824Medium· 6.2libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts (CVE-2026-92824)
CVE-2026-114038Medium· 5.1device-mapper-multipath: device-mapper-multipath: Information disclosure via malformed format string (CVE-2026-114038)
CVE-2026-114041Medium· 6.5freerdp: FreeRDP: Windows RD Gateway consent message heap out-of-bounds read (CVE-2026-114041)
CVE-2026-114044Medium· 5.3freerdp: FreeRDP: Android client heap out-of-bounds read via graphics pipeline (CVE-2026-114044)