CVE-2026-18728Medium· 6.5▾ SunlitA flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to ca…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A flaw was found in open-iscsi. An integer underflow vulnerability in the iscsiuio component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the iscsiuio process crashing. This issue affects systems where iscsiuio is actively handling IPv4 DHCP traffic.
iscsi-initiator-utils (all versions)iscsi-initiator-utils (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this issue, restrict network access to iscsiuio-managed interfaces. Configure firewall rules to limit DHCP/BOOTP traffic to only trusted infrastructure within the local broadcast domain. This reduces the exposure to untrusted systems that could send crafted IPv4 DHCP packets. If iscsiuio is actively using IPv4 DHCP, consider reconfiguring it to use static IP addresses or a different network configuration if feasible. Changes to network configuration may require a service restart.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18727Medium· 6.5Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing
CVE-2026-2369Medium· 6.5Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources
CVE-2026-18726Medium· 6.5Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
CVE-2026-33999High· 7.8Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling
CVE-2026-11850Medium· 5.0Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read