---
id: "CVE-2026-115485"
kind: "vulnerability"
aliases: ["CVE-2026-115485"]
title: "open-iscsi iscsiuio: crafted DHCPv6 packet crashes daemon, corrupts initiator name"
severity: "medium"
cvss: 6.3
epss: 0.002
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iscsi", "linux", "open-iscsi", "self-hosted"]
not_affected_if: ["ipv4-only", "no-iscsiuio", "static-network-config"]
published_at: "2026-10-23T01:16:53+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:00:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115485", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115485", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# open-iscsi iscsiuio: crafted DHCPv6 packet crashes daemon, corrupts initiator name

The iscsiuio daemon in open-iscsi calls strlen() on DHCPv6 option data that is not NUL-terminated, so it reads past the buffer. An attacker on the same network segment who sends a crafted DHCPv6 Advertise message can crash the daemon, overwrite one byte of heap, or corrupt the iSCSI initiator name.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether iscsiuio is installed and running, for example with `systemctl status iscsiuio` or `ps -ef | grep iscsiuio`
- Check the installed open-iscsi version with `iscsiadm --version`, then compare it with the fixed version in the vendor advisory (unknown in the sources)

## Fix

- Update open-iscsi to a release that includes the fix for this CVE (fixed version: unknown in the sources)
- Until patched, stop iscsiuio if your iSCSI setup does not need it, for example `systemctl stop iscsiuio`

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115485
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115485

## From the sources

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_