CVE-2026-18728 — MEDIUM (6.5)

Vulnerability Description

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Redhat	Enterprise Linux	9.0

Related Weaknesses (CWE)

CWE-191

References

https://access.redhat.com/security/cve/CVE-2026-18728Vendor AdvisoryMitigation
https://bugzilla.redhat.com/show_bug.cgi?id=2463029Issue TrackingVendor Advisory

FAQ

What is CVE-2026-18728?

CVE-2026-18728 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on...

How severe is CVE-2026-18728?

CVE-2026-18728 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-18728?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux.