CVE-2026-44932

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44932

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44932.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44932

Downstream

openSUSE (2)

SUSE (5)

Related

openSUSE (2)

SUSE (5)

Published

2026-06-16T15:26:51Z

Modified

2026-10-28T02:31:00Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

indirect remote shell command injection via unsanitized DHCP options in wicked

Details

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Database specific

{
    "cna_assigner": "suse",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44932.json"
}

References

Affected packages

Git / github.com/opensuse/wicked

Affected ranges

Type

GIT

Repo

https://github.com/opensuse/wicked

Events

Introduced

Fixed

6cb69874f5df67b6e22d599a3568a64a8db97e81

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.6.79"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "version-0.6.79",
            "range": [
                {
                    "fixed": "6cb69874f5df67b6e22d599a3568a64a8db97e81"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other

factory-2013091601

factory-2013091801

factory-2013091802

factory-2013092701

factory-2013100201

factory-2013120601

factory-2014010901

factory-rq-213496

factory-rq-214306

factory-rq-214794

factory-rq-221054

version-0.*

version-0.5.1

version-0.5.10

version-0.5.11

version-0.5.12

version-0.5.13

version-0.5.14

version-0.5.15

version-0.5.16

version-0.5.17

version-0.5.18

version-0.5.19

version-0.5.2

version-0.5.20

version-0.5.21

version-0.5.22

version-0.5.23

version-0.5.24

version-0.5.25

version-0.5.26

version-0.5.27

version-0.5.28

version-0.5.29

version-0.5.3

version-0.5.30

version-0.5.31

version-0.5.32

version-0.5.33

version-0.5.34

version-0.5.35

version-0.5.36

version-0.5.37

version-0.5.38

version-0.5.4

version-0.5.5

version-0.5.6

version-0.5.7

version-0.5.8

version-0.5.9

version-0.6.0

version-0.6.1

version-0.6.10

version-0.6.11

version-0.6.12

version-0.6.13

version-0.6.14

version-0.6.15

version-0.6.16

version-0.6.17

version-0.6.18

version-0.6.19

version-0.6.2

version-0.6.20

version-0.6.21

version-0.6.22

version-0.6.23

version-0.6.24

version-0.6.25

version-0.6.26

version-0.6.27

version-0.6.28

version-0.6.29

version-0.6.3

version-0.6.30

version-0.6.31

version-0.6.32

version-0.6.33

version-0.6.34

version-0.6.35

version-0.6.36

version-0.6.37

version-0.6.38

version-0.6.39

version-0.6.4

version-0.6.40

version-0.6.41

version-0.6.42

version-0.6.43

version-0.6.44

version-0.6.45

version-0.6.46

version-0.6.47

version-0.6.48

version-0.6.49

version-0.6.5

version-0.6.50

version-0.6.51

version-0.6.52

version-0.6.53

version-0.6.54

version-0.6.55

version-0.6.56

version-0.6.57

version-0.6.6

version-0.6.60

version-0.6.61

version-0.6.62

version-0.6.64

version-0.6.65

version-0.6.66

version-0.6.67

version-0.6.68

version-0.6.69

version-0.6.7

version-0.6.70

version-0.6.71

version-0.6.72

version-0.6.73

version-0.6.74

version-0.6.75

version-0.6.76

version-0.6.77

version-0.6.78

version-0.6.8

version-0.6.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44932.json"