CVE-2026-115485

CVE-2026-115485 · Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

CVSS 6.3 · Medium · EPSS 0.2%

Published

2026-10-23T00:16:30.006Z

Updated

2026-10-23T00:16:30.006Z

Stack: system

Check your server →