CVE-2026-56117
- Source
- https://cve.org/CVERecord?id=CVE-2026-56117
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56117.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-56117
- Downstream
- Related
- Published
- 2026-06-23T16:14:31.918Z
- Modified
- 2026-08-12T16:41:25.136004Z
- Severity
-
- 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- dhcpcd Heap Use-After-Free via Control Socket Handling
- Details
-
dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing controlrecvdata() to free the client object while the same READ+HANGUP event subsequently reaches controlhangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.
- Database specific
{ "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56117.json", "cna_assigner": "VulnCheck" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56117.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-56117
- https://www.vulncheck.com/advisories/dhcpcd-heap-use-after-free-via-control-socket-handling
- https://github.com/NetworkConfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34
- https://github.com/NetworkConfiguration/dhcpcd
Affected packages
Git / github.com/networkconfiguration/dhcpcd
Affected ranges
- Type
- GIT
- Repo
- https://github.com/networkconfiguration/dhcpcd
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "10.3.2" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
v10.*
v10.0.0
v10.0.1
v10.0.10
v10.0.2
v10.0.3
v10.0.4
v10.0.5
v10.0.6
v10.0.7
v10.0.8
v10.0.9
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.2.3
v10.2.4
v10.3.0
v10.3.1
v10.3.2
v3.*
v3.2.3
v5.*
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.2.0
v5.2.1
v5.2.10
v5.2.11
v5.2.12
v5.2.2
v5.2.3
v5.2.4
v5.2.6
v5.2.7
v5.2.9
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.6.0
v5.6.1
v5.6.2
v5.99.3
v5.99.6
v5.99.7
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.1.0
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.11.0
v6.11.1
v6.11.2
v6.11.3
v6.2.0
v6.2.1
v6.3.0
v6.3.1
v6.3.2
v6.4.0
v6.4.1
v6.4.2
v6.4.3
v6.4.4
v6.4.5
v6.4.6
v6.4.7
v6.5.0
v6.5.1
v6.6.0
v6.6.1
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.7.0
v6.7.1
v6.8.0
v6.8.1
v6.8.2
v6.9.0
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v7.*
v7.0.0
v7.0.0-beta1
v7.0.0-beta2
v7.0.0-beta3
v7.0.0-rc1
v7.0.0-rc2
v7.0.0-rc3
v7.0.0-rc4
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.5a
v7.0.5b
v7.0.6
v7.0.7
v7.0.8
v7.1.0
v7.1.1
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.1.0
v8.1.1
v8.1.2
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.1.0
v9.1.1
v9.1.2
v9.1.3
v9.1.4
v9.2.0
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.3.4
v9.4.0
Database specific
vanir_signatures
[
{
"target": {
"function": "control_recvdata",
"file": "src/control.c"
},
"id": "CVE-2026-56117-1550f410",
"signature_type": "Function",
"digest": {
"function_hash": "30665076437582413154610109046224715519",
"length": 937.0
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
},
{
"target": {
"file": "src/privsep-control.c"
},
"id": "CVE-2026-56117-6a8e8392",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304370523648041404047810095483057266416",
"112643596218417110436226758176183826972",
"256132686304579955189597399639954446409",
"189721698018038900566037010992004691531",
"252653526298248649850720066574043147608",
"85735261469830735859405660553437410263",
"17591820830228821156756814928928559154",
"222188765133158313984809322290663194803"
]
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
},
{
"target": {
"function": "control_handle_read",
"file": "src/control.c"
},
"id": "CVE-2026-56117-726557d5",
"signature_type": "Function",
"digest": {
"function_hash": "105169968804789044052030225171588060692",
"length": 685.0
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
},
{
"target": {
"file": "src/control.h"
},
"id": "CVE-2026-56117-7e3a9072",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292631727150257082732320891101947107792",
"18854740744478829169379194784774919217"
]
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
},
{
"target": {
"file": "src/control.c"
},
"id": "CVE-2026-56117-7ebf0d05",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302711286260322939303136564649170948470",
"209391935812902456629196319662702605645",
"283824720169069741346760221490603153566",
"15529641396289263726963515045617581155",
"286164242918564162612985177872395989700",
"225463417948978504140185435082325219111",
"235830798385811534946716541503465421446",
"120541811190776650801895581670177875319",
"338174302935373644558917478834332243573",
"129522336854596328161028750890691085973",
"208890587684199868702561071243337015233",
"297295444819886776360825326696600298970",
"281299114440421253739314820631998153108",
"34640212144680866237907179714035863224",
"66034038455055283348936460300310147819",
"326279541571763941172882820987611782961",
"188677540648595946408526239814204279295",
"93608017027556889200588356982077922556",
"66763968228103140767802547336805030459",
"182398018157518835903401147400210413389",
"172019367256567295890215060961945434610",
"99196896255088440646810112702178343028",
"263669399054012136534247817437546632433",
"177947482186007919103452647577452870068",
"30962430013767440357385559790068400496",
"143928277832734695611403049014038438511",
"210685058252905129820932680936554972082",
"200532540656170979646393638888546771622",
"75456249938699936718504899542714432712",
"156108367594828507003655815917457486547",
"83975113963284803852551611439014369277",
"177628413937751570863754455572457092960",
"277506570007174431977608415294171726835",
"279044788486821855719991005377932913736",
"208233348434675371280672654405390021911",
"212732809248545040738478888129139820914",
"35793913859967181909770608457242140863",
"331599498941483900517458939451052485563",
"74659404814298399878006284193240014099",
"192856331888594632629745606070674733401",
"175787169908705231976806139644660627172",
"93101884927672384265750149709588653813",
"150657233818902117266454857809174839855",
"92468734271021577526152641221214988092",
"251229629271610280439403323989763141882",
"302041525277210792679770417486905743435",
"21868305679449107772397541905391977980",
"174708121024427643578270079042469656199",
"9487556864791192204637138793955011078",
"177335164865062796754288727948369458014",
"293949540968280903538352693917672011553",
"108587633537507210242609878158511307392",
"58199349692808166832952237426572549626",
"45080600947383915051920825315021225419"
]
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
},
{
"target": {
"function": "control_handle_data",
"file": "src/control.c"
},
"id": "CVE-2026-56117-91ffa2aa",
"signature_type": "Function",
"digest": {
"function_hash": "285046906503227143625369167537145057496",
"length": 421.0
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
},
{
"target": {
"function": "ps_ctl_dispatch",
"file": "src/privsep-control.c"
},
"id": "CVE-2026-56117-d507326f",
"signature_type": "Function",
"digest": {
"function_hash": "338103616939191026331902864038405703076",
"length": 814.0
},
"signature_version": "v1",
"source": "https://github.com/networkconfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
"deprecated": false
}
]
vanir_signatures_modified
"2026-08-12T16:41:25Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56117.json"