An out‑of‑bounds read occurs in the DHCPv4 packet capture code of wicked, where the IP total length is mistakenly used as the payload length for parsing DHCP options. The over‑read is limited to at most 68 bytes but can cause the DHCP client to interpret adjacent heap memory as option data, potentially leaking internal structure such as allocator metadata or pointer values into lease information. No memory write occurs, and there is no demonstrated remote exfiltration mechanism, so the exploit cannot be used to run arbitrary code but can reveal sensitive runtime data.

The vulnerability affects the SUSE wicked network management daemon up to and including version 0.6.80. This includes installations on SUSE Linux Enterprise and openSUSE distributions that rely on wicked for DHCP client functionality.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be on the same local network and able to send crafted DHCP/UDP packets; the attack is unauthenticated and exploits the DHCP client’s parsing logic. Because the read is bounded and cannot modify memory, the risk primarily involves potential information disclosure rather than remote code execution.