This vulnerability involves a NULL pointer dereference in the dhcpcd 10.3.0 codebase, specifically in the parse_option() function located in src/if-options.c at line 1886. When parsing configuration options, an unexpected or invalid token causes a lookup to return NULL for a 'struct dhcp_opt' pointer, which is then accessed without validation, resulting in a runtime error and abort. The issue was identified through instrumented fuzzing builds. No CVSS score or vendor advisory is available, and no patch or remediation level has been published.

The vulnerability causes a NULL pointer dereference leading to a runtime error and process abort, which can result in denial of service by crashing the dhcpcd process. There is no information indicating privilege escalation, data corruption, or remote code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific workaround or temporary fix is documented.