CVE-2026-42511

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42511", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-04-28T05:31:44.956Z", "datePublished": "2026-04-30T06:56:36.929Z", "dateUpdated": "2026-05-01T15:25:37.800Z"}, "containers": {"cna": {"datePublic": "2026-04-29T19:00:00.000Z", "title": "Remote code execution via malicious DHCP options", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["dhclient"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.0-RELEASE", "lessThan": "p7"}, {"status": "affected", "versionType": "release", "version": "14.4-RELEASE", "lessThan": "p3"}, {"status": "affected", "versionType": "release", "version": "14.3-RELEASE", "lessThan": "p12"}, {"status": "affected", "versionType": "release", "version": "13.5-RELEASE", "lessThan": "p13"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Joshua Rogers of AISLE Research Team"}], "descriptions": [{"lang": "en", "value": "The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.\n\nA rogue DHCP server may be able to execute arbirary code as root on a system running dhclient."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-149", "description": "CWE-149: Improper Neutralization of Quoting Syntax", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-04-30T06:56:36.929Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-01T03:55:55.336127Z", "id": "CVE-2026-42511", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T15:25:37.800Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-42511", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-01T03:55:55.336127Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-30T13:06:50.212Z"}}], "cna": {"title": "Remote code execution via malicious DHCP options", "credits": [{"lang": "en", "type": "finder", "value": "Joshua Rogers of AISLE Research Team"}], "affected": [{"vendor": "FreeBSD", "modules": ["dhclient"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.0-RELEASE", "lessThan": "p7", "versionType": "release"}, {"status": "affected", "version": "14.4-RELEASE", "lessThan": "p3", "versionType": "release"}, {"status": "affected", "version": "14.3-RELEASE", "lessThan": "p12", "versionType": "release"}, {"status": "affected", "version": "13.5-RELEASE", "lessThan": "p13", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2026-04-29T19:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.\n\nA rogue DHCP server may be able to execute arbirary code as root on a system running dhclient."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-149", "description": "CWE-149: Improper Neutralization of Quoting Syntax"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-04-30T06:56:36.929Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42511", "state": "PUBLISHED", "dateUpdated": "2026-05-01T15:25:37.800Z", "dateReserved": "2026-04-28T05:31:44.956Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-04-30T06:56:36.929Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["dhclient"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p7", "status": "affected", "version": "15.0-RELEASE", "versionType": "release"}, {"lessThan": "p3", "status": "affected", "version": "14.4-RELEASE", "versionType": "release"}, {"lessThan": "p12", "status": "affected", "version": "14.3-RELEASE", "versionType": "release"}, {"lessThan": "p13", "status": "affected", "version": "13.5-RELEASE", "versionType": "release"}]}], "source": "secteam@freebsd.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*", "matchCriteriaId": "947F561E-AD65-43B9-94C1-3109A3D35248", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*", "matchCriteriaId": "4216D505-95A5-4FCC-8B9A-26FCD32B0445", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*", "matchCriteriaId": "3D1987F1-1E08-4B28-8D16-D25A091D99ED", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*", "matchCriteriaId": "4C859EE2-59C0-4234-BFF0-7794AC4956DD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*", "matchCriteriaId": "D1CEB391-5FA3-4FFD-9279-113093DD500D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*", "matchCriteriaId": "EE54A637-BD2A-42F2-A155-CF3D4292B32D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*", "matchCriteriaId": "BEC1E8A0-0402-45F1-938D-FEFDCFC3E747", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*", "matchCriteriaId": "D94457D6-738F-4ABB-BD46-F2B621531FE2", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*", "matchCriteriaId": "8C38CB56-B80C-4D1B-9267-16E8F985B170", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*", "matchCriteriaId": "13DF1E38-5E8D-42FF-A4C5-092300864F3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*", "matchCriteriaId": "83A86F81-0965-4600-835A-496756137998", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*", "matchCriteriaId": "987E31A4-7E21-471E-A3EA-4E53FFDB3DFB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*", "matchCriteriaId": "9FBFE8B3-DC7C-4394-B062-C40E201EC059", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*", "matchCriteriaId": "563C1D65-625D-43FC-A7A0-75B1E2163C40", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*", "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*", "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*", "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*", "matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*", "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*", "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*", "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*", "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*", "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*", "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*", "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*", "matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*", "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*", "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*", "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*", "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*", "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*", "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.\n\nA rogue DHCP server may be able to execute arbirary code as root on a system running dhclient."}, {"lang": "es", "value": "El campo de archivo BOOTP se escribe en el archivo de concesi\u00f3n sin escapar las comillas dobles incrustadas, permitiendo la inyecci\u00f3n de directivas dhclient.conf arbitrarias. Cuando el archivo de concesi\u00f3n es posteriormente re-analizado por dhclient, por ejemplo, despu\u00e9s de un reinicio del sistema, un campo controlado por el atacante de la concesi\u00f3n se pasa a dhclient-script(8), que lo eval\u00faa.\n\nUn servidor DHCP malicioso podr\u00eda ejecutar c\u00f3digo arbitrario como root en un sistema que ejecuta dhclient."}], "id": "CVE-2026-42511", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42511", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-01T03:55:55.336127Z", "version": "2.0.3"}}]}, "published": "2026-04-30T07:16:37.290", "references": [{"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-149"}], "source": "secteam@freebsd.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0-RELEASE,p7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.4-RELEASE,p3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.3-RELEASE,p12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[13.5-RELEASE,p13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeBSD", "source": "cna", "vendor": "FreeBSD"}, "product": "freebsd", "vendor": "freebsd"}], "created": "2026-04-30T08:20:16.665148+00:00", "updated": "2026-05-02T00:30:16.084906+00:00", "vendors": ["freebsd", "freebsd$PRODUCT$freebsd"]}