What’s Vulnerable › Vulnerabilities

CVE-2026-18728: Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-08-25
• Weakness: CWE-191

Description

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.

Affected products

• Red Hat Enterprise Linux: 9.0, 10.0

References

• https://access.redhat.com/security/cve/CVE-2026-18728
• https://bugzilla.redhat.com/show_bug.cgi?id=2463029

Get alerted when CVE-2026-18728 or the next vulnerability affects your stack