CVE-2026-42511
Freebsd 13.5 … 15.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-42511 is a high-severity Improper Neutralization of Quoting Syntax (CWE-149) vulnerability in Freebsd Freebsd. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-42511 is a vulnerability in the dhclient DHCP client where the BOOTP file field is written to the lease file without escaping embedded double-quotes. This flaw enables the injection of arbitrary dhclient.conf directives into the lease file. When the lease file is subsequently re-parsed by dhclient, such as after a system restart, the attacker-controlled content is passed to dhclient-script(8) for evaluation. The issue affects systems running dhclient and is associated with CWE-149.
A rogue DHCP server can exploit this vulnerability by supplying a malicious BOOTP file field to a victim system. No special privileges or user interaction are required from the attacker or victim, though the attack has high complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1). Successful exploitation leads to arbitrary code execution as root when the tainted lease is processed.
The FreeBSD Security Advisory SA-26:12.dhclient provides details on mitigation and patches at https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26350
Vulnerability Data
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease…
more
is passed to dhclient-script(8), which evaluates it. A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops malformed or injected quoting syntax from reaching parsers and causing unexpected actions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and quoting handling to prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect quote-injection but does not itself implement the fix.
Secure development life cycle mandates input validation and output encoding that directly prevent quote-injection flaws.
Application security requirements explicitly call for neutralization of special characters such as quotes.
Secure architecture principles reduce the attack surface but do not prescribe the specific quoting-neutralization technique.
Secure coding standards require proper escaping or parameterization, directly eliminating CWE-149.