CVE-2026-56117

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing controlrecvdata() to free the client object while the same READ+HANGUP event subsequently reaches controlhangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56117.json"
}

References

Affected packages

Git / github.com/networkconfiguration/dhcpcd

Affected ranges

Type

GIT

Repo

https://github.com/networkconfiguration/dhcpcd

Events

Introduced

Fixed

78ea09ed1633a583dbcde6e7bab9df4639ec8a34

Database specific

Show details

{
    "cpe": "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.3.2"
        }
    ]
}

Affected versions

v10.*

v10.0.0

v10.0.1

v10.0.10

v10.0.2

v10.0.3

v10.0.4

v10.0.5

v10.0.6

v10.0.7

v10.0.8

v10.0.9

v10.1.0

v10.2.0

v10.2.1

v10.2.2

v10.2.3

v10.2.4

v10.3.0

v10.3.1

v10.3.2

v3.*

v3.2.3

v5.*

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.2.0

v5.2.1

v5.2.10

v5.2.11

v5.2.12

v5.2.2

v5.2.3

v5.2.4

v5.2.6

v5.2.7

v5.2.9

v5.5.0

v5.5.1

v5.5.2

v5.5.3

v5.5.4

v5.5.5

v5.5.6

v5.6.0

v5.6.1

v5.6.2

v5.99.3

v5.99.6

v5.99.7

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.0.5

v6.1.0

v6.10.0

v6.10.1

v6.10.2

v6.10.3

v6.11.0

v6.11.1

v6.11.2

v6.11.3

v6.2.0

v6.2.1

v6.3.0

v6.3.1

v6.3.2

v6.4.0

v6.4.1

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.5.0

v6.5.1

v6.6.0

v6.6.1

v6.6.2

v6.6.3

v6.6.4

v6.6.5

v6.6.6

v6.6.7

v6.7.0

v6.7.1

v6.8.0

v6.8.1

v6.8.2

v6.9.0

v6.9.1

v6.9.2

v6.9.3

v6.9.4

v7.*

v7.0.0

v7.0.0-beta1

v7.0.0-beta2

v7.0.0-beta3

v7.0.0-rc1

v7.0.0-rc2

v7.0.0-rc3

v7.0.0-rc4

v7.0.1

v7.0.2

v7.0.3

v7.0.4

v7.0.5

v7.0.5a

v7.0.5b

v7.0.6

v7.0.7

v7.0.8

v7.1.0

v7.1.1

v8.*

v8.0.0

v8.0.1

v8.0.2

v8.0.3

v8.0.4

v8.0.5

v8.0.6

v8.1.0

v8.1.1

v8.1.2

v9.*

v9.0.0

v9.0.1

v9.0.2

v9.1.0

v9.1.1

v9.1.2

v9.1.3

v9.1.4

v9.2.0

v9.3.0

v9.3.1

v9.3.2

v9.3.3

v9.3.4

v9.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56117.json"

vanir_signatures

[
    {
        "id": "CVE-2026-56117-1550f410",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "function": "control_recvdata",
            "file": "src/control.c"
        },
        "signature_type": "Function",
        "digest": {
            "length": 937.0,
            "function_hash": "30665076437582413154610109046224715519"
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-56117-6a8e8392",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "file": "src/privsep-control.c"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "304370523648041404047810095483057266416",
                "112643596218417110436226758176183826972",
                "256132686304579955189597399639954446409",
                "189721698018038900566037010992004691531",
                "252653526298248649850720066574043147608",
                "85735261469830735859405660553437410263",
                "17591820830228821156756814928928559154",
                "222188765133158313984809322290663194803"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-56117-726557d5",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "function": "control_handle_read",
            "file": "src/control.c"
        },
        "signature_type": "Function",
        "digest": {
            "length": 685.0,
            "function_hash": "105169968804789044052030225171588060692"
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-56117-7e3a9072",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "file": "src/control.h"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "292631727150257082732320891101947107792",
                "18854740744478829169379194784774919217"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-56117-7ebf0d05",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "file": "src/control.c"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "302711286260322939303136564649170948470",
                "209391935812902456629196319662702605645",
                "283824720169069741346760221490603153566",
                "15529641396289263726963515045617581155",
                "286164242918564162612985177872395989700",
                "225463417948978504140185435082325219111",
                "235830798385811534946716541503465421446",
                "120541811190776650801895581670177875319",
                "338174302935373644558917478834332243573",
                "129522336854596328161028750890691085973",
                "208890587684199868702561071243337015233",
                "297295444819886776360825326696600298970",
                "281299114440421253739314820631998153108",
                "34640212144680866237907179714035863224",
                "66034038455055283348936460300310147819",
                "326279541571763941172882820987611782961",
                "188677540648595946408526239814204279295",
                "93608017027556889200588356982077922556",
                "66763968228103140767802547336805030459",
                "182398018157518835903401147400210413389",
                "172019367256567295890215060961945434610",
                "99196896255088440646810112702178343028",
                "263669399054012136534247817437546632433",
                "177947482186007919103452647577452870068",
                "30962430013767440357385559790068400496",
                "143928277832734695611403049014038438511",
                "210685058252905129820932680936554972082",
                "200532540656170979646393638888546771622",
                "75456249938699936718504899542714432712",
                "156108367594828507003655815917457486547",
                "83975113963284803852551611439014369277",
                "177628413937751570863754455572457092960",
                "277506570007174431977608415294171726835",
                "279044788486821855719991005377932913736",
                "208233348434675371280672654405390021911",
                "212732809248545040738478888129139820914",
                "35793913859967181909770608457242140863",
                "331599498941483900517458939451052485563",
                "74659404814298399878006284193240014099",
                "192856331888594632629745606070674733401",
                "175787169908705231976806139644660627172",
                "93101884927672384265750149709588653813",
                "150657233818902117266454857809174839855",
                "92468734271021577526152641221214988092",
                "251229629271610280439403323989763141882",
                "302041525277210792679770417486905743435",
                "21868305679449107772397541905391977980",
                "174708121024427643578270079042469656199",
                "9487556864791192204637138793955011078",
                "177335164865062796754288727948369458014",
                "293949540968280903538352693917672011553",
                "108587633537507210242609878158511307392",
                "58199349692808166832952237426572549626",
                "45080600947383915051920825315021225419"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-56117-91ffa2aa",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "function": "control_handle_data",
            "file": "src/control.c"
        },
        "signature_type": "Function",
        "digest": {
            "length": 421.0,
            "function_hash": "285046906503227143625369167537145057496"
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-56117-d507326f",
        "deprecated": false,
        "source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
        "target": {
            "function": "ps_ctl_dispatch",
            "file": "src/privsep-control.c"
        },
        "signature_type": "Function",
        "digest": {
            "length": 814.0,
            "function_hash": "338103616939191026331902864038405703076"
        },
        "signature_version": "v1"
    }
]

vanir_signatures_modified

"2026-08-12T16:41:25Z"