Most recent entries from all

fkie_cve-2026-102720

2026-10-01T07:44:28.580877+00:00

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a

kilobyte past the end of the received message.

The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:

```c

/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */

while (i < length - 1)

{

... size = *(++data); /* data moves 1: type -> length byte */ data += size + 1; /* data moves size + 1 more */ i += size + 1; /* i moves only size + 1 */

}

```

A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so

the offset falls one byte behind the real read position for every option the walk skips. After

enough skipped options the check `i < length - 1` still holds while `data` is already past the end

of the message, and the subsequent read of the type and length bytes comes from whatever follows.

A single OFFER carrying a long run of skippable options is enough:

```

ERROR: AddressSanitizer: heap-buffer-overflow

READ of size 1 at 0x61b000000794 thread T5

#0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541 #1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082

0x61b000000794 is located 164 bytes to the right of 1648-byte region

```

A well formed OFFER through the same path is handled normally, the client records the offer and

moves to REQUESTING, so the difference is the…

GHSA-rw53-r2p7-qgmf

2026-10-01T07:44:28.581023+00:00