dhcpcd contains a heap use‑after‑free flaw in its DHCPv6 handling. A crafted DHCPv6 RENEW reply that includes an RFC6603 OPTION_PD_EXCLUDE with both preferred and valid lifetimes set to zero can cause the daemon to free a delegated child address while another function still holds a reference to it. When the iterator later accesses the freed pointer, the program crashes. This loss of service can disrupt network connectivity for clients that rely on dhcpcd, and the weaknesses are characterized as CWE‑416 and CWE‑825.

NetworkConfiguration’s dhcpcd package up through version 10.3.2 is affected. The issue was fixed by commit 5733d3c, so any system running an earlier release should apply that patch or a later version.

The CVSS score of 6 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation evidence. Likely attack vector is a local attacker on the same network link impersonating a DHCPv6 server and sending a crafted RENEW message. Based on the description, it is inferred that no authentication is required to trigger the flaw. The exploitation results in a crash of dhcpcd, causing a temporary denial of service for local clients that rely on DHCPv6.