CVE-2026-18103: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Red Hat Red Hat Enterprise Linux 6
A buffer overflow vulnerability exists in the dhcp-server component of Red Hat Enterprise Linux 6. An attacker with network access to the OMAPI port (7911), if not secured with TSIG key authentication, can send a specially crafted lease creation request containing an overly long InfiniBand MAC address. This triggers a buffer overflow in the print_hw_addr() function, causing the dhcpd service to crash and preventing it from restarting without manual intervention, resulting in a persistent denial of service.
AI Analysis
Technical Summary
CVE-2026-18103 is a buffer overflow vulnerability in the dhcp-server's print_hw_addr() function in Red Hat Enterprise Linux 6. The flaw can be exploited remotely by an attacker with network access to the OMAPI port (7911) if TSIG key authentication is not configured. The attacker sends a specially crafted lease creation request with an overly long InfiniBand MAC address, triggering a buffer overflow that crashes the dhcpd service. The crash is persistent because the service cannot restart without manual removal of the problematic lease entry from /var/lib/dhcpd/dhcpd.leases. This vulnerability leads to a denial of service condition affecting availability but does not impact confidentiality or integrity.
Potential Impact
Successful exploitation causes a persistent denial of service by crashing the dhcpd service and preventing its automatic restart. This disrupts DHCP services until manual intervention is performed to remove the offending lease entry and restart the service. There is no impact on confidentiality or integrity. Exploitation requires network access to the OMAPI port and absence of TSIG key authentication.
Mitigation Recommendations
To mitigate this vulnerability, configure TSIG key authentication on the OMAPI port (7911) to prevent unauthorized access. If the dhcpd service has crashed due to this flaw, manually remove the problematic InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases and then restart the dhcpd service. Note that restarting the service may temporarily interrupt DHCP services for clients. No official patch or fix is currently confirmed; check the vendor advisory for updates.
CVE-2026-18103: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Red Hat Red Hat Enterprise Linux 6
Description
A buffer overflow vulnerability exists in the dhcp-server component of Red Hat Enterprise Linux 6. An attacker with network access to the OMAPI port (7911), if not secured with TSIG key authentication, can send a specially crafted lease creation request containing an overly long InfiniBand MAC address. This triggers a buffer overflow in the print_hw_addr() function, causing the dhcpd service to crash and preventing it from restarting without manual intervention, resulting in a persistent denial of service.
CVSS v3.1
Score 4.9medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18103 is a buffer overflow vulnerability in the dhcp-server's print_hw_addr() function in Red Hat Enterprise Linux 6. The flaw can be exploited remotely by an attacker with network access to the OMAPI port (7911) if TSIG key authentication is not configured. The attacker sends a specially crafted lease creation request with an overly long InfiniBand MAC address, triggering a buffer overflow that crashes the dhcpd service. The crash is persistent because the service cannot restart without manual removal of the problematic lease entry from /var/lib/dhcpd/dhcpd.leases. This vulnerability leads to a denial of service condition affecting availability but does not impact confidentiality or integrity.
Potential Impact
Successful exploitation causes a persistent denial of service by crashing the dhcpd service and preventing its automatic restart. This disrupts DHCP services until manual intervention is performed to remove the offending lease entry and restart the service. There is no impact on confidentiality or integrity. Exploitation requires network access to the OMAPI port and absence of TSIG key authentication.
Mitigation Recommendations
To mitigate this vulnerability, configure TSIG key authentication on the OMAPI port (7911) to prevent unauthorized access. If the dhcpd service has crashed due to this flaw, manually remove the problematic InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases and then restart the dhcpd service. Note that restarting the service may temporarily interrupt DHCP services for clients. No official patch or fix is currently confirmed; check the vendor advisory for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-28T17:35:42.520Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-18103","vendor":"Red Hat"}]
Threat ID: 6a727538bf8831d539a7b09f
Added to database: 08/04/2026, 23:26:48 UTC
Last enriched: 08/04/2026, 23:47:34 UTC
Last updated: 08/04/2026, 23:47:34 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.