# CVE-2026-115485: open-iscsi iscsiuio DHCPv6 parser buffer over-read

Source: https://junglewise.ai/threats/cve-2026-115485-a-flaw-was-found-in-the-iscsiuio-component-of-open-iscsi-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115485 · Severity: medium · CVSS 6.3 · Published 2026-10-23

A flaw in open-iscsi's DHCPv6 option parser can be triggered by an attacker on the same network segment by sending a specially crafted DHCPv6 message. The vulnerability may cause the iscsiuio daemon to crash, corrupt the iSCSI initiator name, or overwrite a byte in heap memory, disrupting iSCSI storage connectivity.

Technologies: [Open-iSCSI Project Open-Iscsi](https://junglewise.ai/threats/technologies/open-iscsi). Vendors: [Open-iSCSI Project](https://junglewise.ai/threats/vendors/open-iscsi-project).

## Quick answers

**Is CVE-2026-115485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115485 being exploited in the wild.

**How severe is CVE-2026-115485?** Medium severity, with a CVSS score of 6.3, published 23 October 2026.

**Which products and versions are affected?** open-iscsi project open-iscsi.

**Is there a fix for CVE-2026-115485?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115485 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115485?** Check whether you run Open-iSCSI Project Open-Iscsi. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DHCPv6 option parser in iscsiuio calls strlen() on raw network data without first ensuring a NUL terminator is present, resulting in a buffer over-read into heap memory. An attacker on the same network segment can craft a malicious DHCPv6 Advertise message to trigger the flaw, leading to daemon crash, heap memory corruption, or iSCSI initiator name corruption.

## Affected products

- open-iscsi project open-iscsi

## Timeline

- 2026-10-23: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-115485](https://access.redhat.com/security/cve/CVE-2026-115485)

## Related threats

- [open-iscsi Double Free in open-isns attrs.c](https://junglewise.ai/threats/cve-2026-55995-open-iscsi-double-free-in-open-isns-attrs-c)
- [open-iscsi incorrect authorization in iscsiuio control socket](https://junglewise.ai/threats/cve-2026-44944-open-iscsi-incorrect-authorization-in-iscsiuio-control-socket)
- [open-iscsi path traversal in discovery IQN handling](https://junglewise.ai/threats/cve-2026-44943-open-iscsi-path-traversal-in-discovery-iqn-handling)