The flaw is a one-byte stack out-of-bounds write in the function dhcp6_makemessage() within dhcpcd, representing a stack buffer overrun (CWE‑787). It is triggered when a DHCPv6 ADVERTISE message contains an oversized RFC6603 OPTION_PD_EXCLUDE option body, allowing an unauthenticated attacker on the same link to write beyond a fixed local buffer. The vulnerability can corrupt adjacent stack memory, which may lead to program failure or unintended behavior.

The vulnerability affects all releases of dhcpcd up to and including version 10.3.2 provided by the NetworkConfiguration project. A fix was introduced in commit 2f00c7b, which added bounds checking to dhcp6_makemessage. Any system running dhcpcd 10.3.2 or older that receives DHCPv6 PD configuration is potentially impacted.

The CVSS score of 6 places the flaw at medium severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Attackers must be on the same link as the target and send a carefully crafted DHCPv6 ADVERTISE packet. The overflow can potentially corrupt stack memory; based on the description, this could lead to a crash or other unintended behavior. The overall risk is moderate, but mitigation is advised.