CVE-2026-56099 is an out-of-bounds read vulnerability in OpenBSD prior to commit 6a23123 (dated 2026-06-18). The issue is located in the mpls_do_error function within sys/netmpls/mpls_input.c. Remote attackers can exploit this by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set, causing disclosure of kernel stack memory. The vulnerability has a CVSS 4.0 score of 6.9, indicating a medium severity impact. There is no explicit vendor advisory or patch information available at this time.

Successful exploitation allows remote attackers to read kernel stack memory, potentially disclosing sensitive information from the kernel space. The vulnerability does not require privileges, user interaction, or authentication, and has low attack complexity. However, it does not provide integrity or availability impacts, limiting the scope to information disclosure only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor OpenBSD security advisories for updates addressing this vulnerability. Until a patch is available, consider restricting exposure of MPLS processing interfaces to untrusted networks if feasible.