{"id":"CVE-2026-115484","title":"Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg","summary":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same n…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"iscsi-initiator-utils","affected":["iscsi-initiator-utils (all versions)","iscsi-initiator-utils","iscsi-initiator-utils (all versions)","iscsi-initiator-utils (all versions)","iscsi-initiator-utils (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T02:44:48.598677Z"},"published":"2026-10-23","updated":"2026-10-29","sourceUpdated":"2026-10-29T02:44:58.365Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115484","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-115484"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556265","label":"RHBZ#2556265"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115484"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115484"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00222,"epssPercentile":0.12765,"ingestedAt":"2026-10-23T01:11:52.506Z","slug":"CVE-2026-115484","body":"## Overview\n\nA flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.\n\n## Affected\n\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils`\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRestrict untrusted systems from the L2 broadcast domain where iscsiuio-managed interfaces operate. If IPv4 DHCP is not required for iSCSI boot, configure static IP addressing. Where DHCP must remain enabled, limit DHCP/BOOTP traffic so only trusted infrastructure can reach the affected host.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}