CVE-2026-71402 wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length

An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client wickedd-dhcp4 rea...

CVE-2026-71402

CVE-2026-71402 is an out-of-bounds read in the DHCPv4 packet capture code of wicked (the openSUSE/SUSE network daemon), specifically in ni_capture_inspect_udp_header() in src/capture.c. The function reports the IP total length as the payload length instead of the remaining UDP payload length, cau...