Executive brief
lldpd is a network service that allows devices to discover each other on a local network. A flaw in how it handles certain network traffic (VLAN-tagged frames) can allow a nearby attacker to crash the service. This results in a denial-of-service, preventing the device from properly communicating its identity or discovering other equipment on the network.
Technical details
An out-of-bounds (OOB) read exists in lldpd_decode() within src/daemon/lldpd.c. When stripping 802.1Q VLAN tags, the code uses memmove() to shift the frame payload. The length argument for this operation is calculated incorrectly as 's - 2 * ETHER_ADDR_LEN' instead of 's - 2 * ETHER_ADDR_LEN - 4'. If a received frame's size equals the interface MTU, this results in a 4-byte over-read past the heap-allocated buffer. This can be exploited by an unauthenticated attacker on the same Layer 2 broadcast domain to cause a denial-of-service (DoS) via a daemon crash. The issue is fixed in version 1.0.22.
Affected products
- lldpd lldpd < 1.0.22
Timeline
- 2026-05-12: patched: Fix merged in pull request #787
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE-2026-46433 published to NVD