CVE-2019-11577: dhcpcd DHCPv6 NA/TA address parsing buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no privileges or interaction required, and a very high EPSS percentile make this a high-impact, likely-exploitable memory corruption flaw.

What it is

dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses. A remote attacker can send crafted DHCPv6 responses that overflow a memory buffer in the DHCP client. Because dhcpcd runs as a system service, this can lead to code execution or a crash on affected hosts.

Impact

An attacker can corrupt memory in the dhcpcd process, potentially achieving remote code execution with the privileges of the dhcpcd service or causing a denial of service.

Attack surface

The flaw is reachable over the network via DHCPv6 traffic (CVSS AV:N, PR:N, UI:N), so no authentication or user interaction is required. An attacker on the same network segment or able to spoof DHCPv6 responses can trigger it.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is high (0.53095, 98.9th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade dhcpcd to version 7.2.1 or later, which contains the patch commit referenced in the advisory.
• If immediate upgrade is not possible, restrict DHCPv6 traffic to trusted servers using network segmentation or DHCPv6 snooping where supported.
• Monitor dhcpcd processes for crashes or abnormal restarts and treat repeated failures as potential exploitation attempts.
• Apply vendor or distribution backports for dhcpcd if the base version cannot be changed.

Detection

• Monitor for dhcpcd crashes, core dumps, or unexpected process restarts on hosts using DHCPv6.
• Inspect DHCPv6 server logs and network traffic for malformed or unusually large NA/TA address options.
• Use host-based detection to flag dhcpcd spawning unexpected child processes or making outbound connections after DHCPv6 activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.