How do I check whether I am affected by CVE-2026-115680?

- Check the installed MDK-Middleware version in the Keil MDK pack manager, and see whether it falls in `8.0.0` to `8.3.0`. - Confirm whether the project enables the DHCPv6 client stack from MDK-Middleware (Network component).

What is the fix for CVE-2026-115680?

- Move MDK-Middleware to a version newer than `8.3.0` once Arm publishes a fixed release (unknown from sources).

Who is not affected by CVE-2026-115680?

Not affected if: dhcpv6-not-used.

Live › vulnerability › CVE-2026-115680

Go to dashboard

unknownInfrastructure

Arm Keil MDK-Middleware: DHCPv6 option parsing over-reads and retransmits data

Arm Keil MDK-Middleware 8.0.0 through 8.3.0 may mishandle DHCPv6 options, reading past buffer bounds and retransmitting unintended data. The sources do not state the exact impact beyond information disclosure of memory contents.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Unknown; over-reads may leak device memory contents.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Embedded firmware teams building with Arm Keil MDK-Middleware 8.0.0 through 8.3.0 that use its DHCPv6 networking support. Projects that do not compile in DHCPv6 or use a different networking stack are likely unaffected, but the sources do not confirm this.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-115680

Go to dashboard

unknownInfrastructure

Arm Keil MDK-Middleware: DHCPv6 option parsing over-reads and retransmits data

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Unknown; over-reads may leak device memory contents.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Arm Keil MDK-Middleware: DHCPv6 option parsing over-reads and retransmits data

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

Arm Keil MDK-Middleware: DHCPv6 option parsing over-reads and retransmits data

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources