Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110912

Quick assessment

Affected
DragonFlyBSD DragonFlyBSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 DragonFly BSD 6.4.2 版本及之前（具体为提交 4bb22ff 之前的版本）中，ARP 输入处理函数 arpintr() 和 in_arpinput()（位于 sys/netinet/if_ether.c）未对传入 ARP 报文中的硬件地址长度（ar_hln）和协议地址长度（ar_pln）字段进行有效性验证。随后，函数 in_arpreply() 会使用这些由攻击者控制的值作为 memcpy 的长度，从大小仅为 6 字节和 4 字节的内核缓冲区中复制数据，导致对内核堆和栈内存的越界读取，并将读取

CVSS 7.1 · High EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProduct Version RangeStatus
DragonFlyBSD DragonFlyBSD 984263bcb83ad82313113c6ac840d99124d8f90c< 4bb22ffcf2e9fb44995fbfd9945194afc87fb182 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110912

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
长度参数不一致性处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
DragonFlyBSD DragonFlyBSD 984263bcb83ad82313113c6ac840d99124d8f90c ~ 4bb22ffcf2e9fb44995fbfd9945194afc87fb182 -

II. Public POCs for CVE-2026-110912

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110912

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110912 (1)

Exploits & Public PoCs for CVE-2026-110912 (1)

IV. Related Vulnerabilities

Same weakness: CWE-130

V. Comments for CVE-2026-110912

No comments yet

Leave a comment