---
id: CVE-2026-115484
title: >-
  Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in
  iscsiuio parse_msg
summary: >-
  A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option
  parser incorrectly calculates the length of the options data, causing it to
  read beyond the allocated buffer into adjacent heap memory. An attacker on the
  same n…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: iscsi-initiator-utils
affected:
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils (all versions)
  - iscsi-initiator-utils (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T02:44:48.598677Z'
published: '2026-10-23'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T02:44:58.365Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115484'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115484'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2556265'
    label: RHBZ#2556265
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115484'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115484'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00222
epssPercentile: 0.12765
ingestedAt: '2026-10-23T01:11:52.506Z'
---

## Overview

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

## Affected

- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils`
- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils (all versions)`
- `iscsi-initiator-utils (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Restrict untrusted systems from the L2 broadcast domain where iscsiuio-managed interfaces operate. If IPv4 DHCP is not required for iSCSI boot, configure static IP addressing. Where DHCP must remain enabled, limit DHCP/BOOTP traffic so only trusted infrastructure can reach the affected host.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115484.json)