CVE-2026-56114 dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()

Medium 6.0 Published 23 Jun 2026 Updated 28 Jul 2026

Unauthenticated attackers can trigger a stack out-of-bounds write in dhcpcd via crafted DHCPv6 messages, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-56114?

CVE-2026-56114 is a medium-severity memory corruption vulnerability in NetworkConfiguration dhcpcd, published on 23 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.

Weakness: CWE-787

Which versions are affected by CVE-2026-56114?

It affects 1 product.

Products include Dhcpcd Project Dhcpcd.

How do I fix CVE-2026-56114?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-56114 being exploited?

There is no known exploitation of CVE-2026-56114 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-56114, AZL-90216, BELL-CVE-2026-56114, DEBIAN-CVE-2026-56114, GHSA-8q8g-fjv5-5h56, UBUNTU-CVE-2026-56114.