CVE-2026-115863 ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115863?
CVE-2026-115863 is a high-severity vulnerability in ConnMan, published on 23 Oct 2026.
Official description
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
Weakness: CWE-121
Which versions are affected by CVE-2026-115863?
How do I fix CVE-2026-115863?
No fix has been published for CVE-2026-115863 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115863 being exploited?
There is no known exploitation of CVE-2026-115863 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115863, GHSA-725f-6r9j-c4hf, UBUNTU-CVE-2026-115863.