High 7.1Published Oct 15, 2026

CVE-2026-110912In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address le…

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects DragonFlyBSD. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.17%, higher than 6% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for DragonFlyBSD

Exploited in the last 30 days

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.

CVSS: 7.1 HIGH (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-130
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.17% (percentile 6)
Assigned by: mitre
NVD analysis: Deferred
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

DragonFlyBSD DragonFlyBSD dragonflybsd:dragonflybsd (from the name)	984263bcb83ad82313113c6ac840d99124d8f90c builds before 4bb22ffcf2e9fb44995fbfd9945194afc87fb182	CNA record

References

https://github.com/DragonFlyBSD/DragonFlyBSD/commit/4bb22ffcf2e9fb44995fbfd9945194afc87fb182
https://github.com/dreamfast/CVE-2026-110912

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.