CVE-2026-115863

HighCVSS 7.6

Published: 23/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

ConnMan through 2.0 has a stack-based buffer overflow in get_domains in gdhcp/client.c triggered by a DHCPv6 Reply message. It copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of at least 1025 non-zero bytes makes the label walk leave the buffer and read/write past its end. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY.

Risk Assessment

An unauthenticated attacker on the local network can crash connmand running as root, and potentially cause further effects from memory corruption. This can disrupt network configuration on affected devices.

Recommendation

Update ConnMan to a version containing the fix or restrict the vulnerable functionality. Until then, consider disabling DHCPv6 or limiting trust in DHCPv6 servers on the network.

Other vulnerabilities in ConnMan

CVE-2017-12865Critical
CVE-2017-12865 describes a stack-based buffer overflow in 'dnsproxy.c' in connman versions 1.34 and earlier. This allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the 'name' variable.

Original NVD description (English source)

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS