CVE-2026-44932: indirect remote shell command injection via unsanitized DHCP options in wicked

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-16 · updated 2026-10-25
Weakness: CWE-78

Description

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Affected products

SUSE wicked: before 0.6.79 — fixed in 0.6.79

How to fix

Upgrade to a fixed version: SUSE wicked 0.6.79. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=1265221
https://github.com/openSUSE/wicked/releases/tag/version-0.6.79
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026689.html
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026690.html
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026691.html

Get alerted when CVE-2026-44932 or the next vulnerability affects your stack