CVE-2026-71401

An integer underflow in the wicked DHCPv4 packet capture code (function ni_capture_inspect_udp_header() in src/capture.c) allows an unauthenticated attacker on an adjacent network to trigger an out-of-bounds read past the receive buffer in the wickedd-dhcp4 daemon. The IP total length field is no...

CVE-2026-71401 wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read

An integer underflow was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader in src/capture.c does not verify that the IP total length field iplen is at least as large as the IP header length ihl before subtracting the header length. An unauthenticated attacker on the sam...