CVE-2026-42511
Remote code execution via malicious DHCP options
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it. A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.
| CWE | CWE-149 |
| Vendor | freebsd |
| Product | freebsd |
| Published | Apr 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for freebsd freebsd
Be the first to know when new unknown vulnerabilities affecting freebsd freebsd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FreeBSD / FreeBSD
15.0-RELEASE < p7 14.4-RELEASE < p3 14.3-RELEASE < p12 13.5-RELEASE < p13
References
Credits
Joshua Rogers of AISLE Research Team