CVE-2026-56113 is a heap use-after-free vulnerability in the dhcpcd DHCP client daemon up to version 10.3.2. The issue arises when a DHCPv6 RENEW reply containing the RFC6603 OPTION_PD_EXCLUDE with both preferred and valid lifetimes set to zero is processed. An attacker impersonating a DHCPv6 server can cause the function dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still references the freed pointer. This leads to a use-after-free condition when TAILQ_REMOVE is called, resulting in a crash of the daemon. The vulnerability requires the attacker to be on the same link and does not require privileges or user interaction.

Successful exploitation allows an unauthenticated attacker on the same network link to crash the dhcpcd daemon, causing a denial of service. There is no indication of code execution or information disclosure from the provided data. The CVSS 4.0 base score is 6.0 (medium severity), reflecting the potential for disruption but limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 5733d3c, but no official patch or release version is explicitly stated in the provided data. Users should monitor the vendor's communications for an official fix and apply it once available. Until then, restricting DHCPv6 server access to trusted sources on the local network may reduce exposure.