# CVE-2026-71402: wicked DHCPv4 packet capture out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-71402-wicked-dhcpv4-packet-capture-out-of-bounds-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71402 · Severity: medium · CVSS 5.4 · Published 2026-08-27

wicked is a network configuration daemon used on Linux systems to manage network interfaces and DHCP settings. An unauthenticated attacker on the same network can send a specially crafted DHCP packet to trigger an out-of-bounds memory read of up to 68 bytes beyond the packet buffer. While this does not allow direct data exfiltration, heap memory contents such as allocator metadata could be leaked through the DHCP client response, potentially aiding further attacks.

Technologies: [Opensuse Wicked](https://junglewise.ai/threats/technologies/wicked). Vendors: [Opensuse](https://junglewise.ai/threats/vendors/opensuse).

## Quick answers

**Is CVE-2026-71402 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71402 being exploited in the wild.

**How severe is CVE-2026-71402?** Medium severity, with a CVSS score of 5.4, published 27 August 2026.

**Which products and versions are affected?** Opensuse Wicked up to and including 0.6.80.

**Is there a fix for CVE-2026-71402?** A patch was published on 2026-08-27: Patch merged in PR #1079 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71402 attacked?** It is attacked from the adjacent network or over the network, in a hosted service.

**Am I affected by CVE-2026-71402?** Check whether you run Opensuse Wicked at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds read in the DHCPv4 packet capture code of wicked, specifically in the ni_capture_inspect_udp_header() function in src/capture.c. The function incorrectly uses the IP total length field as the UDP payload length, rather than calculating the remaining UDP payload length. This causes the DHCP option walker in the wickedd-dhcp4 client to read up to ihl + 8 bytes (maximum 68 bytes) past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network can trigger this by sending a crafted DHCP/UDP packet, allowing the DHCP client to parse adjacent heap memory as DHCP options and potentially leak allocator metadata or pointer values into lease fields. No memory write or remote exfiltration mechanism has been demonstrated. A patch is available via openSUSE/wicked Pull Request #1079.

## Affected products

- openSUSE wicked up to and including 0.6.80

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: patched: Patch merged in PR #1079

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=1274627](https://bugzilla.suse.com/show_bug.cgi?id=1274627)
- [https://github.com/openSUSE/wicked/pull/1079](https://github.com/openSUSE/wicked/pull/1079)

## Related threats

- [wicked integer underflow in DHCPv4 packet capture](https://junglewise.ai/threats/cve-2026-71401-wicked-integer-underflow-in-dhcpv4-packet-capture)
- [openSUSE wicked command injection via unsanitized DHCP options](https://junglewise.ai/threats/cve-2026-44932-opensuse-wicked-command-injection-via-unsanitized-dhcp-options)