A one‑byte stack out‑of‑bounds write (CWE‑787) occurs in dhcp6_makemessage() when the function serializes an oversized RFC6603 OPTION_PD_EXCLUDE option body. An unauthenticated attacker on the same physical link can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128; this triggers the write beyond a fixed local buffer and corrupts adjacent stack memory, creating an opportunity for arbitrary code execution.

The vulnerability exists in dhcpcd versions up to and including 10.3.2 released by NetworkConfiguration. Any system running an affected dhcpcd that participates in DHCPv6 configuration is at risk. This includes routers, embedded devices, and operating systems that use dhcpcd for IPv6 address autoconfiguration.

The CVSS score of 6 indicates moderate severity. The exploit requires no authentication and is limited to the local Ethernet or Wi‑Fi segment. EPSS information is unavailable, and the issue is not listed in the CISA KEV catalog, so no publicly available exploit code is reported. However, an attacker present on the network segment can trigger the out‑of‑bounds write by sending a single crafted DHCPv6 message, making the vulnerability a straightforward local attack.