dhcpcd contains a heap use‑after‑free vulnerability in its control‑socket handling. When privilege separation is disabled, a local unprivileged user can connect to the control socket and issue a privileged command, such as –x. This triggers the client object to be freed during control_recvdata(). A later READ+HANGUP event calls control_hangup() and dereferences the now‑stale pointer, producing memory corruption that can be leveraged to execute arbitrary code. The weakness is categorized as CWE‑416 and CWE‑825.

The flaw affects NetworkConfiguration’s dhcpcd through version 10.3.2 inclusive. Systems that run dhcpcd with the --disable‑privsep option or that experience privilege‑separation initialization failures, leaving the control socket in mode 0666, are especially vulnerable.

The CVSS score of 5.7 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Because the attack vector is local, risk is confined to machines where a non‑privileged user can open the control socket. However, if the daemon runs with elevated privileges, a successful exploitation could lead to full system compromise.