Live › vulnerability › CVE-2026-115485
Go to dashboardThe iscsiuio daemon in open-iscsi calls strlen() on DHCPv6 option data that is not NUL-terminated, so it reads past the buffer. An attacker on the same network segment who sends a crafted DHCPv6 Advertise message can crash the daemon, overwrite one byte of heap, or corrupt the iSCSI initiator name.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts that run iscsiuio on a network segment where an attacker can send DHCPv6 traffic, typically hosts using iSCSI with IPv6 network configuration through iscsiuio. Systems that do not run iscsiuio, or that use only software iSCSI without its DHCPv6 handling, can skip this.
No product ranges from the sources yet.
systemctl status iscsiuio or ps -ef | grep iscsiuioiscsiadm --version, then compare it with the fixed version in the vendor advisory (unknown in the sources)systemctl stop iscsiuioEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
This page as .md · .json · in your agent: get_signal("CVE-2026-115485")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.