The vulnerability arises from a mismatch in how the DHCP client code advances a pointer and an offset while parsing DHCP options. Specifically, the code increments the data pointer by size + 2 bytes for each option but only increments the offset counter by size + 1. This causes the offset to fall behind the pointer, allowing the loop condition to remain true while the pointer has already moved past the message end. Consequently, the client reads memory beyond the DHCP message buffer, leading to an out-of-bounds read (CWE-125). The issue manifests when a DHCP OFFER contains a long sequence of skippable options. The read occurs in the DHCP client thread during interface configuration, potentially exposing memory contents to the attacker.

An attacker controlling a DHCP server or any device on the LAN that responds first to DHCP DISCOVER can exploit this vulnerability to cause the DHCP client to read memory beyond the intended buffer. This out-of-bounds read may disclose sensitive information from adjacent memory. The vulnerability occurs during network interface configuration on every boot when the client is unconfigured, increasing exposure. However, no code execution or denial of service is explicitly described. The CVSS 4.0 score is 5.3 (medium severity) reflecting local network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability can be mitigated by correcting the offset increment to match the pointer advancement (i.e., incrementing the offset by size + 2) or by deriving bounds checks directly from the data pointer rather than maintaining a separate offset counter. Until a patch is available, network administrators should consider restricting DHCP responses to trusted servers and monitoring for unusual DHCP traffic patterns. No official fix or patch link is provided in the current data.