CVE-2026-42512
Published: 30 April 2026
Summary
CVE-2026-42512 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Freebsd Freebsd. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the heap buffer overrun in dhclient by identifying, reporting, and applying patches as specified in the FreeBSD security advisory.
Implements memory safeguards like non-executable memory and address space layout randomization to prevent exploitation of the heap buffer overrun for remote code execution.
Conducts vulnerability scanning to detect the dhclient heap buffer overrun (CVE-2026-42512) and triggers timely remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote heap buffer overflow in the dhclient DHCP client daemon triggered by crafted packets, directly enabling remote code execution on a client application without user interaction.
NVD Description
As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun.…
more
A specially crafted packet can cause dhclient to overrun its buffer of environment entries. This can result in a crash, but it may be possible to leverage this bug to achieve remote code execution.
Deeper analysisAI
CVE-2026-42512 is a heap buffer overrun vulnerability (CWE-122) affecting dhclient, the DHCP client daemon in FreeBSD. The flaw arises when dhclient constructs an environment array of string pointers to pass to dhclient-script and must resize it. The code miscalculates the new array size during memory allocation, resulting in a heap buffer overrun. This vulnerability was published on 2026-04-30.
A remote, unauthenticated attacker can trigger the issue by sending a specially crafted DHCP packet, causing dhclient to overrun its buffer of environment entries. Exploitation leads to a denial-of-service condition through a crash of the dhclient process. Under certain conditions, the buffer overrun may be leveraged for remote code execution. The CVSS v3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network accessibility, high attack complexity, and high impact on confidentiality, integrity, and availability.
The FreeBSD Security Advisory FreeBSD-SA-26:15.dhclient details mitigation measures and available patches, accessible at https://security.freebsd.org/advisories/FreeBSD-SA-26:15.dhclient.asc.
Details
- CWE(s)