CVE-2026-56113: Use After Free in NetworkConfiguration dhcpcd
dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
AI Analysis
Technical Summary
CVE-2026-56113 is a heap use-after-free vulnerability in the dhcpcd daemon (up to version 10.3.2). An attacker acting as or impersonating a DHCPv6 server can send a crafted DHCPv6 RENEW reply with the RFC6603 OPTION_PD_EXCLUDE option, where both preferred and valid lifetimes are zero. This triggers the dhcp6_deprecatedele() function to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds a pointer to the freed memory. When TAILQ_REMOVE is subsequently called, it dereferences the freed pointer, causing a use-after-free condition that can crash the daemon.
Potential Impact
The vulnerability allows unauthenticated attackers on the same link to cause a denial of service by crashing the dhcpcd daemon. There is no indication of code execution or data corruption beyond the crash. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network administrators should consider restricting DHCPv6 server access to trusted devices to reduce exposure to crafted malicious DHCPv6 messages.
CVE-2026-56113: Use After Free in NetworkConfiguration dhcpcd
Description
dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
CVSS v4.0
Score 6.0medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56113 is a heap use-after-free vulnerability in the dhcpcd daemon (up to version 10.3.2). An attacker acting as or impersonating a DHCPv6 server can send a crafted DHCPv6 RENEW reply with the RFC6603 OPTION_PD_EXCLUDE option, where both preferred and valid lifetimes are zero. This triggers the dhcp6_deprecatedele() function to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds a pointer to the freed memory. When TAILQ_REMOVE is subsequently called, it dereferences the freed pointer, causing a use-after-free condition that can crash the daemon.
Potential Impact
The vulnerability allows unauthenticated attackers on the same link to cause a denial of service by crashing the dhcpcd daemon. There is no indication of code execution or data corruption beyond the crash. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network administrators should consider restricting DHCPv6 server access to trusted devices to reduce exposure to crafted malicious DHCPv6 messages.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-18T19:15:10.650Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ab6daeed863c81e4f9f31
Added to database: 06/23/2026, 16:39:54 UTC
Last enriched: 07/30/2026, 00:46:06 UTC
Last updated: 08/06/2026, 12:41:11 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.