CVE-2026-71402: CWE-125 Out-of-bounds read in SUSE wicked

An out-of-bounds read vulnerability exists in wicked's DHCPv4 packet capture code due to ni_capture_inspect_udp_header() misreporting payload length. This leads to the DHCPv4 client reading up to 68 bytes past the 1500-byte packet buffer, parsing adjacent heap memory as DHCP options. An unauthenticated attacker on the same network can exploit this by sending crafted DHCP/UDP packets. The over-read is bounded and does not allow memory writes or remote exfiltration. This affects wicked versions up to and including 0.6.80. No known exploits in the wild or official remediation details are provided.

The vulnerability allows an unauthenticated attacker on the same network to cause the DHCPv4 client to read adjacent heap memory beyond the packet buffer. This could lead to leakage of allocator metadata or pointer values interpreted as DHCP lease fields. However, the over-read is limited to 68 bytes, with no demonstrated ability to write memory or remotely exfiltrate data. The impact is therefore limited to potential information disclosure of adjacent heap contents within the client process memory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider restricting untrusted DHCP traffic on local networks to mitigate potential exploitation.