CVE-2026-71401

Name of the Vulnerable Software and Affected Versions wicked versions prior to 0.6.81

Description An integer underflow exists in the DHCPv4 packet capture code of the wickedd-dhcp4 client. The function ni capture inspect udp header() in src/capture.c fails to verify that the IP total length field ip len is at least as large as the IP header length ihl before performing subtraction. An unauthenticated attacker on the same network can exploit this to trigger an out-of-bounds read past the receive buffer, potentially causing the daemon to crash depending on the process memory layout.

Recommendations Update wicked to a version later than 0.6.80.