Loading story…
The FreeBSD Project disclosed CVE-2026-42511, a critical vulnerability in the default IPv4 DHCP client, dhclient(8), that can allow a local network attacker to execute arbitrary code as root. The flaw arises because dhclient(8) does not properly escape double quotes in the BOOTP file field before writing data to the DHCP lease file, allowing a malicious DHCP response to inject configuration content that is later re-parsed and executed by dhclient-script(8).
Exploitation requires the attacker to be on the same broadcast domain and operate a rogue DHCP server that replies with crafted DHCP data. FreeBSD said the issue affects all currently supported branches, including FreeBSD 15.0, 14.4, 14.3, and 13.5 release and stable versions, and published patches in security advisory FreeBSD-SA-26:12.dhclient. Administrators were urged to update immediately, and FreeBSD noted that switch-level DHCP snooping can help mitigate attacks from rogue DHCP servers where continued use of dhclient is necessary.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-29, FreeBSD published advisories for two additional vulnerabilities credited to AISLE researcher Joshua Rogers: CVE-2026-42512, a remotely triggerable dhclient heap buffer overrun, and CVE-2026-39457, a libnv stack overflow that can enable local privilege escalation through a privileged consumer.
FreeBSD released fixes for supported versions including 15.0, 14.4, 14.3, and 13.5 release and stable branches, and urged administrators to update. The project also noted DHCP snooping on switches as a mitigation where dhclient must remain in use.
The FreeBSD Project issued security advisory FreeBSD-SA-26:12 for CVE-2026-42511, a remote code execution flaw in the default IPv4 DHCP client. The bug allows a local network attacker operating a rogue DHCP server on the same broadcast domain to inject malicious configuration that can later be executed as root by dhclient-script(8).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcefreebsd.org
Open sourcebugflation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat and SUSE disclosed DHCP-related command injection flaws that can let an attacker on the same or adjacent network execute code during system boot. **CVE-2026-6893** affects dracut's legacy networking path, where DHCP-supplied values such as `host-name` are written into temporary shell scripts by `modules.d/35network-legacy/dhclient-script.sh` and later sourced as root inside initramfs. On systems booting with configurations such as `ip=dhcp` and `rd.neednet=1`, a malicious DHCP server can abuse the legacy `dhclient` flow to achieve root code execution before the operating system fully starts. SUSE separately assigned **CVE-2026-44932** to wicked, which writes DHCP option values into `/run/wicked/leaseinfo.*` files without sufficient sanitization. Although wicked does not directly source those files, downstream scripts and components that do can execute attacker-controlled shell metacharacters delivered in DHCP responses, creating an indirect remote shell injection path that SUSE said can reach root-level execution in components including dracut's `network-legacy` module on SLE 15 SP7. Both disclosures tie the risk to unsafe handling of untrusted DHCP data in early-boot networking, and SUSE said it issued security updates across affected product lines.
Jun 29, 2026
FreeBSD released security updates for **22 vulnerabilities** across the operating system, including multiple flaws that could lead to **remote code execution**, **local privilege escalation to root**, **denial of service**, **memory corruption**, and **information disclosure**. The most severe issue, **`CVE-2026-49420`**, affects `libalias`, where improper handling of **RTSP** traffic during NAT processing can allow **remote code execution as root** on systems using **`ipfw` NAT** or **`natd`**. The fixes were shipped in **FreeBSD 15.1-RELEASE-p1**, **15.0-RELEASE-p11**, **14.4-RELEASE-p7**, and **14.3-RELEASE-p16**. Additional patched components include `execve`, **Jail**, **OpenZFS**, **Linuxulator**, **KTLS**, `sound`, `vt`, `ptrace`, IPv6 multicast filtering, `tcp_rack`, `compat32`, `iconv`, and pathname resolution protections such as **`AT_RESOLVE_BENEATH`**, with the advisory noting that **13 of the issues** could enable privilege escalation to root.
Jul 7, 2026
OpenWrt released **v25.12.5** with urgent fixes for multiple security issues in default-enabled network services, including **CVE-2026-62948**, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into `/tmp/odhcpd.leases` through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the **LuCI** “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to **25.12.5** and carries a high-impact `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` rating. The service release also patches additional vulnerabilities across **odhcpd**, **uhttpd**, **LuCI**, **cgi-io**, and **ead**, alongside updates to the Linux kernel, **OpenSSL**, **musl libc**, and **dropbear**. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for **CVE-2026-62948** indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Jul 15, 2026