ConnMan through version 2.0 contains a stack‑based buffer overflow in the DHCPv6 reply handling routine. The vulnerability is triggered by a crafted DHCPv6 DOMAIN_LIST option, which copies up to 1025 bytes into a 1026‑byte buffer without validating the actual length and then walks DNS labels with an unbounded loop. The resulting out‑of‑bounds read/write can be controlled by the attacker and results in a crash of connmand, which runs as root.

All ConnMan releases up to and including 2.0 are affected. The issue was introduced in the commit bb06c471 and applies to the ConnMan:ConnMan product line.

The CVSS score of 7.6 reflects a high likelihood of successful exploitation with moderate impact. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an on‑link attacker to forge a Router Advertisement and a DHCPv6 reply matching the client identifier; authentication is not required. Once triggered, the crash of a root‑privileged process prevents normal network operation on the device, effectively denying service to all users on the affected host.