CVE-2026-42511: Remote code execution via malicious DHCP options
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it. A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42511?
CVE-2026-42511 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2026-42511?
To fix CVE-2026-42511, update to the patched version of ISC dhclient or FreeBSD that addresses the vulnerability.
What systems are affected by CVE-2026-42511?
CVE-2026-42511 affects ISC dhclient and FreeBSD versions 13.5 and 14.3 or later.
What kind of attacks can exploit CVE-2026-42511?
CVE-2026-42511 can be exploited through remote code execution via malicious DHCP options.
What is the attack vector for CVE-2026-42511?
The attack vector for CVE-2026-42511 is through the injection of arbitrary directives into the dhclient lease file.