CVE-2026-18727Medium· 6.5▾ SunlitA flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advert…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
iscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
If DHCPv6 is not required for iscsiuio, disable DHCPv6 handling for the relevant network interface. If DHCPv6 is necessary, restrict network exposure to trusted adjacent networks and implement firewall rules to prevent forged DHCPv6 server traffic from reaching clients on shared L2 segments. A system restart or service reload may be required for changes to take effect.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18728Medium· 6.5Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing
CVE-2026-2369Medium· 6.5Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources
CVE-2026-18726Medium· 6.5Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
CVE-2026-33999High· 7.8Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling
CVE-2026-11850Medium· 5.0Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read