CVE-2026-18727
published 2026-08-12CVE-2026-18727: A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration…
PriorityP430medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.19%
7.9th percentile
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in open-iscsi's iscsiuio component.
ghsa_unreviewed·2026-08-13
CVE-2026-18727 [MEDIUM] CWE-191 A flaw was found in open-iscsi's iscsiuio component.
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
Red Hat
open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing
vendor_redhat·2026-08-12·CVSS 6.5
CVE-2026-18727 [MEDIUM] CWE-191 open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing
open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18727 iscsi-initiator-utils: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing [fedora-all]
bugzilla·2026-08-12·CVSS 6.5
CVE-2026-18727 [MEDIUM] CVE-2026-18727 iscsi-initiator-utils: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing [fedora-all]
CVE-2026-18727 iscsi-initiator-utils: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Integer Underflow and Out-of-Bounds Read in DHCPv6 Packet Parsing:
crafted DHCPv6 Advertise traffic with a short UDP length can underflow the
DHCPv6 payload length, drive option parsing past packet bounds, and likely
cause a denial of service in the `iscsiuio` DHCPv6 client path.
Requirements to exploit: The attacker needs adjacent network access on the
same L2 segment as a system
Bugzilla
CVE-2026-18727 open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing
bugzilla·2026-04-26·CVSS 6.5
CVE-2026-18727 [MEDIUM] CVE-2026-18727 open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing
CVE-2026-18727 open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Integer Underflow and Out-of-Bounds Read in DHCPv6 Packet Parsing:
crafted DHCPv6 Advertise traffic with a short UDP length can underflow the
DHCPv6 payload length, drive option parsing past packet bounds, and likely
cause a denial of service in the `iscsiuio` DHCPv6 client path.
Requirements to exploit: The attacker needs adjacent network access on the
same L2 segment as a system running `iscsiuio` with DHCPv6 enabled, plus
the ability to send forged IPv6 UDP traffic from source port `547` to
destination port `546` while the client is in an active DHCPv6 exchange. A
matching transaction ID is also required; the reviewed mate
2026-08-12
Published