Vulnerability · Published Apr 30, 2026 · Assigned by freebsd

CVE-2026-42511Remote code execution via malicious DHCP options

High 8.1

In plain English

A high-severity security flaw in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 62.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it. A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	15.0-RELEASE – before p714.4-RELEASE – before p314.3-RELEASE – before p1213.5-RELEASE – before p13

Weakness: CWE-149 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc vendor-advisory