CVE-2007-5365: OpenBSD dhcpd cons_options stack buffer overflow via DHCP request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is a remotely reachable memory corruption in a core network service with a high EPSS score, though no confirmed exploitation or KEV listing is present.

What it is

The cons_options function in dhcpd's options.c contains a stack-based buffer overflow when a DHCP request specifies a maximum message size smaller than the minimum IP MTU. This affects OpenBSD 4.0 through 4.2 and other dhcpd implementations derived from ISC dhcp-2. A remote attacker can crash the daemon or potentially execute arbitrary code, making it a serious pre-authentication flaw in a core network service.

Impact

An attacker can cause a denial of service by crashing dhcpd, and the overflow may allow arbitrary code execution in the context of the dhcpd process. Successful exploitation could disrupt DHCP service or compromise the host running the daemon.

Attack surface

The flaw is reached through a crafted DHCP request sent to the dhcpd service, which is normally network-facing and requires no authentication. The CVSS vector is recorded as AV:L, which conflicts with the description of a remote attacker; the record does not reconcile this discrepancy.

Exploitation

No public exploitation is confirmed by the record: CVE-2007-5365 is not listed in CISA KEV, no ransomware groups are documented, and references carry only Patch and Vendor Advisory tags. EPSS is high at 0.80265 (99.6th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the OpenBSD errata patches for 4.0, 4.1 and 4.2, or the corresponding vendor updates from Debian, Red Hat, Ubuntu and Sun.
• Upgrade or replace dhcpd implementations based on ISC dhcp-2 that have not received the fix.
• Restrict DHCP traffic to trusted network segments and block DHCP from untrusted or external networks at the perimeter.
• Monitor vendor advisories for updated packages and redeploy patched dhcpd builds.
• If patching is delayed, isolate or disable dhcpd on systems that do not require it.

Detection

• Monitor dhcpd logs and system logs for crashes, restarts or abnormal termination.
• Inspect DHCP request traffic for maximum message size values below the minimum IP MTU.
• Use host or network IDS signatures for malformed DHCP options targeting dhcpd.
• Track unexpected dhcpd process exits or core dumps on DHCP servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.