CVE-2026-44932

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jun 10, 2026, 2:53:50 PM UTC

Updated

Sep 4, 2026, 6:23:11 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.36% · Oct 25, 2026

This update for wicked fixes the following issues: Update to version 0.6.79. - CVE-2026-44932: indirect remote shell command injection due to insufficient sanitization of DHCP options written to `/run/wicked/leaseinfo.*` files (bsc#1265221). - CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing (bsc#1274627). - CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4 capture parsing (bsc#1274627). Changes for wicked: - Version 0.6.79: - Fix to escape single-quotes in leaseinfo dump output used by the `wicked test dhcp4` and `wicked test dhcp6` and written to the `/run/wicked/leaseinfo.*` files, e.g. to pass them to `netconfig`. - Fix `posix-tz-dbname` and `tz-string` option processing checks to permit only valid characters according to RFC4833. - Discard string values containing single-quotes in other options. - Trigger to regenerate `initrd` that may contain wicked binaries on updates from wicked versions <= 0.6.78. - Version 0.6.78: - `man`: small fixes in wireless manpage (gh#opensuse/wicked#1053) - `rtnetlink`: fix `RTM_NEWLINK` name resolution in debug (gh#opensuse/wicked#1052) - Add support for IPVLAN/IPVTAP (jsc#PED-1942, gh#opensuse/wicked#1050, gh#opensuse/wicked#1051) - `fsm`: remove children reference array from worker (gh#opensuse/wicked#1049) - `ifxml`: migrate and generate lower configs/policies (gh#opensuse/wicked#1048) - `fsm`: use refcount and array macros in worker and policy (gh#opensuse/wicked#1047) - `route`: use refcounted array and fix error leaks (gh#opensuse/wicked#1046) - `utils`: add support for refcounted objects in generic array (gh#openSUSE/wicked#1045)