The vulnerability in dhcpcd (up to 10.3.2) is a one-byte stack out-of-bounds write in the dhcp6_makemessage() function located in src/dhcp6.c. An attacker on the same link can exploit this by sending a DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX with a prefix length of /0 and a valid OPTION_PD_EXCLUDE option using an exclude prefix length between /121 and /128. This crafted message causes serialization of an oversized OPTION_PD_EXCLUDE option body, resulting in a one-byte write beyond the bounds of a fixed local buffer on the stack, potentially corrupting adjacent memory. The issue is tracked as CVE-2026-56114 and has a CVSS 4.0 score of 6.0 (medium severity). No known exploits in the wild are reported, and no official remediation level or patch link is provided.

Successful exploitation allows an unauthenticated attacker on the same network link to cause a one-byte out-of-bounds write on the stack in the dhcpcd process. This may lead to memory corruption, which could affect the stability or behavior of the dhcpcd service. The input data does not specify further impacts such as code execution or denial of service, so the impact is limited to potential memory corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in a commit identified as 2f00c7b, but no official patch or vendor advisory content is provided in the input data. Users should monitor the vendor's official channels for a released patch or update. Until then, consider restricting access to the DHCPv6 service from untrusted same-link attackers as a temporary mitigation.