CVE-2026-102720

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: c / addons/dhcp/nxddhcpclient.c:7538, 7572 / while i...

EUVD-2026-89184

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: c / addons/dhcp/nxddhcpclient.c:7538, 7572 / while i...

CVE-2026-102720

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: c / addons/dhcp/nxddhcpclient.c:7538, 7572 / while i...

CVE-2026-102720

The NetxDuo DHCP client is vulnerable to a heap-buffer-overflow due to an incorrect bound check in addons/dhcp/nxd_dhcp_client.c. When parsing TLV options, the pointer data is advanced by size + 2 bytes, but the loop counter i is only advanced by size + 1 bytes. This discrepancy allows a hostile ...