The flaw resides in the iscsiuio component of the open-iscsi package. The DHCPv4 option parser incorrectly calculates the length of option data, causing a heap out‑of‑bounds read. This can lead to a crash or corruption of the iscsi daemon’s network configuration. The weakness is a classic out‑of‑bounds read identified as CWE‑125, and the CVSS score of 7.6 indicates high impact.

The vulnerability affects the Red Hat Enterprise Linux platform across releases 6, 7, 8, 9 and 10, as all versions include the open‑iscsi daemon with the vulnerable parser. Any host running these RHEL releases that uses iscsiuio for iSCSI boot is potentially exposed. No specific sub‑version filtering is listed, so all supported releases are impacted.

The attack vector requires the attacker to be on the same local network segment as the target, where iscsiuio services are listening. With crafted DHCP responses, an adversary can trigger the out‑of‑bounds read to crash the daemon or corrupt memory, resulting in denial of service or disruptive reconfiguration. No exploitation material is publicly available; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and local network exposure still present a tangible risk.