{"id":"CVE-2026-115484","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-115484","generatedAt":"2026-10-28T06:34:56.013Z","title":"An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.","description":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.","published":"2026-10-23T01:16:54.000Z","lastModified":"2026-10-23T16:44:18.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.6,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"},"cwe":["CWE-125"],"affected":[],"epss":{"score":0.00222,"percentile":0.12629,"date":"2026-10-27","history":[{"date":"2026-10-23","score":0.00221,"percentile":0.12019}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-23T01:16:54.000Z","detail":{"score":"7.6","severity":"HIGH","publishedAt":"2026-10-23T01:16:53.670Z"},"summary":"New CVE, high severity (CVSS 7.6)."}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-115484","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556265","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115484","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}