Technical impact
The slaacd and rad daemons in OpenBSD versions up through 7.8 process crafted ICMPv6 Neighbor Discovery options. If an option of length zero is received, the unvalidated calculation of nd_opt_len * 8 - 2 causes the parsing loop to never terminate, resulting in an infinite loop that stalls the daemon. The flaw is a classic example of unchecked input leading to an unbounded loop, classified as CWE‑1284 and CWE‑835.
Affected Systems
This flaw affects the OpenBSD operating system, specifically the SLAACD and RAD network daemons in releases up to 7.8. Network hosts running these daemons are vulnerable. No specific hardware vendors are listed; all OpenBSD installations in this version range are potentially impacted.
Risk and Exploitability
The vulnerability does not carry an inherent network‑wide lateral movement requirement; an attacker only needs local or lateral network access to send a crafted packet to the target host. Because the flaw leads to a denial of service of the affected daemons, any system relying on SLAACD or RAD for address configuration can experience network disruption. The EPSS score is < 1% and the flaw is not listed in KEV, indicating limited known exploitation at this time. Nevertheless, the lack of mitigations beyond the infinite loop makes patching essential.
