lldpd is an LLDP implementation that previously miscalculated the number of bytes to move when stripping 802.1Q VLAN tags from Ethernet frames. The incorrect argument to memmove() caused a four‑byte heap buffer over‑read when a frame size matched the interface MTU, exposing a small portion of heap memory; this involves CWE‑125 and CWE‑131.

All versions of lldpd prior to 1.0.22 are affected. Users running the lldpd daemon on network interfaces that receive LLDP frames should verify their deployment and upgrade if necessary.

With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score of < 1% indicates a very low public exploitation probability, and the issue is not listed in CISA KEV, suggesting low public exploitation activity. Nevertheless, an attacker who can insert crafted VLAN‑tagged frames onto a network segment that the lldpd daemon monitors can trigger the over‑read to leak memory contents, potentially aiding other attacks. The attack vector is local to the network but is viable in environments where untrusted hosts can send LLDP traffic. The vulnerability involves CWE‑125 and CWE‑131.