CVE-2026-10773

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description The DHCPv4 client helper function net dhcpv4 msg type name() in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses sizeof(name) instead of ARRAY SIZE(name), allowing values from 9 up to the byte size of the pointer array to pass. This occurs because the msg type value is read as an unchecked raw byte from the DHCP MESSAGE TYPE option of a received packet via net pkt read u8() and passed unmodified into the lookup.

An attacker or a malicious DHCP server can inject a spoofed DHCP reply to drive the index out of bounds, resulting in a wild-pointer dereference during a %s log conversion. This issue is only triggerable when the DHCPv4 log module is built at the DEBUG level (CONFIG NET DHCPV4 LOG LEVEL DBG), which is not the default configuration. Successful exploitation can lead to a denial of service via a client crash or the disclosure of adjacent pointer contents through log output.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, ensure the DHCPv4 log module is not built at the DEBUG level (CONFIG NET DHCPV4 LOG LEVEL DBG).