CVE-2026-42512: freebsd Heap-based Buffer Overflow

Vulnerability summary

CVE-2026-42512 is a high (CVSS 8.1) Heap-based Buffer Overflow vulnerability in freebsd. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.3% of scored vulnerabilities.

Timeline

1. 30-04-2026
   PublishedVulnerability first disclosed.
2. 01-05-2026
   Last modifiedVulnerability information updated.

Description

As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun. A specially crafted packet can cause dhclient to overrun its buffer of environment entries. This can result in a crash, but it may be possible to leverage this bug to achieve remote code execution.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().