An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the header length. An unauthenticated attacker on the same network can thereby trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client (wickedd-dhcp4), which can crash the daemon depending on the process memory layout. No information disclosure has been demonstrated. This issue affects wicked up to and including version 0.6.80.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Thu, 27 Aug 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the header length. An unauthenticated attacker on the same network can thereby trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client (wickedd-dhcp4), which can crash the daemon depending on the process memory layout. No information disclosure has been demonstrated. This issue affects wicked up to and including version 0.6.80. | |
| Title | wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read | |
| Weaknesses | CWE-191 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: suse
Published:
Updated: 2026-08-27T15:01:27.342Z
Reserved: 2026-08-06T11:38:54.896Z
Link: CVE-2026-71401
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-27T17:19:44.830
Modified: 2026-08-27T17:19:44.830
Link: CVE-2026-71401
Redhat
No data.
OpenCVE Enrichment
No data.