The vulnerability in dhcpcd (up to version 10.3.2) is a one-byte stack out-of-bounds write in the dhcp6_makemessage() function located in src/dhcp6.c. It occurs when an attacker sends a DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX with a prefix length of /0 and a valid OPTION_PD_EXCLUDE option using an exclude prefix length between /121 and /128. This crafted message causes serialization of an oversized RFC6603 OPTION_PD_EXCLUDE option body, resulting in a one-byte write beyond the local buffer on the stack. The vulnerability allows unauthenticated attackers on the same link to potentially corrupt adjacent stack memory. The issue is fixed in commit 2f00c7b, but no official patch release or advisory details are provided.

An unauthenticated attacker on the same link can exploit this vulnerability by sending a crafted DHCPv6 ADVERTISE message to trigger a one-byte stack out-of-bounds write. This may corrupt adjacent stack memory, potentially leading to unpredictable behavior or denial of service. No evidence of known exploits in the wild is reported. The CVSS 4.0 score is 6.0 (medium severity), reflecting the local attack vector and potential high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 2f00c7b, so applying the corresponding patch or updating to a version including this fix is recommended once available. Until then, limit exposure by restricting access to trusted networks and monitoring DHCPv6 traffic for suspicious OPTION_PD_EXCLUDE usage. No official vendor advisory or patch link is provided in the current data.