CVE-2025-70102: dhcpcd: NULL Pointer Dereference in Configuration Option Parsing

As cited

Copy frozen at 2026-10-30 13:52 UTC (site build).

vulnerabilities

CVE-2025-70102: dhcpcd: NULL Pointer Dereference in Configuration Option Parsing

CVE-2025-70102 is a NULL pointer dereference vulnerability in dhcpcd 10.3.0 that occurs during configuration option parsing in the parse_option() function. The flaw allows an attacker to craft malicious configuration input that triggers a crash by dereferencing a NULL struct dhcp_opt pointer. The issue affects the option processing logic in src/if-options.c.

Why it matters: dhcpcd administrators and distributions packaging version 10.3.0 should update immediately, as the NULL pointer dereference can cause service denial; confirm whether your deployment is affected and patch or disable untrusted configuration sources.

Source published

2026-10-30 12:20 UTC

First seen by Cybersecurity Tracker

2026-10-30 13:02 UTC