CVE-2026-44932

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44932
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44932.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-44932
Downstream
openSUSE (2)
SUSE (5)
Related
openSUSE (2)
SUSE (5)
Published
2026-06-16T15:26:51Z
Modified
2026-09-04T18:26:38Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
indirect remote shell command injection via unsanitized DHCP options in wicked
Details

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Database specific 
{
    "cna_assigner":  "suse",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44932.json"
}
References

Affected packages

Git / github.com/opensuse/wicked

Affected ranges

Type
GIT
Repo
https://github.com/opensuse/wicked
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6cb69874f5df67b6e22d599a3568a64a8db97e81
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.6.79"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
factory-2013091601
factory-2013091801
factory-2013091802
factory-2013092701
factory-2013100201
factory-2013120601
factory-2014010901
factory-rq-213496
factory-rq-214306
factory-rq-214794
factory-rq-221054
version-0.*
version-0.5.1
version-0.5.10
version-0.5.11
version-0.5.12
version-0.5.13
version-0.5.14
version-0.5.15
version-0.5.16
version-0.5.17
version-0.5.18
version-0.5.19
version-0.5.2
version-0.5.20
version-0.5.21
version-0.5.22
version-0.5.23
version-0.5.24
version-0.5.25
version-0.5.26
version-0.5.27
version-0.5.28
version-0.5.29
version-0.5.3
version-0.5.30
version-0.5.31
version-0.5.32
version-0.5.33
version-0.5.34
version-0.5.35
version-0.5.36
version-0.5.37
version-0.5.38
version-0.5.4
version-0.5.5
version-0.5.6
version-0.5.7
version-0.5.8
version-0.5.9
version-0.6.0
version-0.6.1
version-0.6.10
version-0.6.11
version-0.6.12
version-0.6.13
version-0.6.14
version-0.6.15
version-0.6.16
version-0.6.17
version-0.6.18
version-0.6.19
version-0.6.2
version-0.6.20
version-0.6.21
version-0.6.22
version-0.6.23
version-0.6.24
version-0.6.25
version-0.6.26
version-0.6.27
version-0.6.28
version-0.6.29
version-0.6.3
version-0.6.30
version-0.6.31
version-0.6.32
version-0.6.33
version-0.6.34
version-0.6.35
version-0.6.36
version-0.6.37
version-0.6.38
version-0.6.39
version-0.6.4
version-0.6.40
version-0.6.41
version-0.6.42
version-0.6.43
version-0.6.44
version-0.6.45
version-0.6.46
version-0.6.47
version-0.6.48
version-0.6.49
version-0.6.5
version-0.6.50
version-0.6.51
version-0.6.52
version-0.6.53
version-0.6.54
version-0.6.55
version-0.6.56
version-0.6.57
version-0.6.6
version-0.6.60
version-0.6.61
version-0.6.62
version-0.6.64
version-0.6.65
version-0.6.66
version-0.6.67
version-0.6.68
version-0.6.69
version-0.6.7
version-0.6.70
version-0.6.71
version-0.6.72
version-0.6.73
version-0.6.74
version-0.6.75
version-0.6.76
version-0.6.77
version-0.6.78
version-0.6.8
version-0.6.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44932.json"