iscsiuio, the user‑space initiator of open‑iscsi, has a flaw in its DHCPv6 vendor option parsing routine. The implementation calls strlen() on raw network data without first ensuring a NUL terminator, which allows the function to read past the bounds of the packet buffer into unrelated heap memory. The over‑read can also trigger a 1‑byte heap overwrite and may corrupt the iSCSI initiator name. These bugs together can cause the daemon to crash, leading to a denial of service, or modify the initiator identity, which affects authentication integrity.

The vulnerability affects the iscsiuio component shipped with Red Hat Enterprise Linux 10 through 9. All five Red Hat distributions that include open‑iscsi are potentially impacted. The flaw resides in the DHCPv6 option parsing logic, so any RHEL system using iscsiuio on a network that permits DHCPv6 advertisement traffic may be vulnerable.

With a CVSS score of 6.3 and no EPSS data, the exploit likelihood is considered moderate, and the flaw is not listed in CISA’s KEV catalog. The attack vector is inferred to be a local network segment: an adversary on the same Layer 2 subnet can send a crafted DHCPv6 Advertise message to trigger the exploit. Successful exploitation would crash the iscsiuio daemon and could potentially alter the initiator name, resulting in availability loss or credential tampering.