CVE-2026-18728
published 2026-08-13CVE-2026-18728: A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol…
PriorityP427medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.19%
8.1th percentile
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing
vendor_redhat·2026-08-12·CVSS 6.5
CVE-2026-18728 [MEDIUM] CWE-191 open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing
open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
Statement: This flaw in `iscsi-initiator-utils` is rated Moderate. It allows an adjacent-network attacker to trigger a denial of service by sending a crafted IPv4/UDP DHCP reply to systems where `iscsiuio` is configured to use IPv4 DHCP
VulDB
open-iscsi IPv4 DHCP Parser integer underflow (EUVD-2026-57715 / CNNVD-2026-98310409)
vuldb·2026-08-17·CVSS 6.5
CVE-2026-18728 [MEDIUM] open-iscsi IPv4 DHCP Parser integer underflow (EUVD-2026-57715 / CNNVD-2026-98310409)
A vulnerability marked as very critical has been reported in open-iscsi. This affects an unknown function of the component IPv4 DHCP Parser. This manipulation causes integer underflow.
This vulnerability is registered as CVE-2026-18728. Remote exploitation of the attack is possible. No exploit is available.
GHSA
A flaw was found in open-iscsi.
ghsa_unreviewed·2026-08-13
CVE-2026-18728 [MEDIUM] CWE-191 A flaw was found in open-iscsi.
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18728 iscsi-initiator-utils: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing [fedora-all]
bugzilla·2026-08-12
CVE-2026-18728 [MEDIUM] CVE-2026-18728 iscsi-initiator-utils: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing [fedora-all]
CVE-2026-18728 iscsi-initiator-utils: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Integer Underflow in IPv4 TCP/UDP Payload Length Calculation:
malformed IPv4 packets can underflow `ustack->uip_len` in `uip_process()`,
and in DHCP-enabled deployments the wrapped length is later trusted by the
DHCP client, leading to out-of-bounds reads and denial of service.
Requirements to exploit: Adjacent-network access to the target's L2
segment, a deployment where `iscsi
Bugzilla
CVE-2026-18728 open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing
bugzilla·2026-04-26
CVE-2026-18728 [MEDIUM] CVE-2026-18728 open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing
CVE-2026-18728 open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing
AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
Summary: Integer Underflow in IPv4 TCP/UDP Payload Length Calculation:
malformed IPv4 packets can underflow `ustack->uip_len` in `uip_process()`,
and in DHCP-enabled deployments the wrapped length is later trusted by the
DHCP client, leading to out-of-bounds reads and denial of service.
Requirements to exploit: Adjacent-network access to the target's L2
segment, a deployment where `iscsiuio` is using IPv4 DHCP
(`IPV4_CONFIG_DHCP`), and the ability to send a crafted IPv4/UDP DHCP reply
that reaches the DHCP parse path, including matching the expected
`DHCP_REPLY`/`xid`/`chaddr` checks and any ordinary packet validation
enforced by t
2026-08-13
Published