CVE-2026-10773: DHCPv4 Client DOS Vulnerability

CVE-2026-10773 Overview

CVE-2026-10773 is an out-of-bounds read vulnerability in the Zephyr real-time operating system (RTOS) DHCPv4 client. The flaw resides in net_dhcpv4_msg_type_name() within subsys/net/lib/dhcpv4/dhcpv4.c. The helper indexes an 8-element const char * name table using an unchecked value taken directly from a received DHCP packet. A malformed bounds guard uses sizeof(name) instead of ARRAY_SIZE(name), so pointer-sized byte counts pass the check and the lookup reads past the array. The condition is reachable only when the DHCPv4 log module is built at debug level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), which is not the default.

Critical Impact
A DHCP server or an attacker on the adjacent network can send a crafted reply that crashes the DHCPv4 client and potentially leaks adjacent pointer data through log output.

Affected Products

Zephyr Project RTOS — DHCPv4 client (subsys/net/lib/dhcpv4/dhcpv4.c)
Zephyr Project RTOS — DHCPv6 client (subsys/net/lib/dhcpv6/dhcpv6.c), which contains the same defect pattern
Builds with CONFIG_NET_DHCPV4_LOG_LEVEL_DBG enabled

Discovery Timeline

2026-08-01 - CVE-2026-10773 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-10773

Vulnerability Analysis

The net_dhcpv4_msg_type_name() helper returns a human-readable string for a DHCPv4 message type. It performs a bounds check with msg_type <= sizeof(name) before returning name[msg_type - 1]. Because name is an array of const char * pointers, sizeof(name) returns the total byte size of the array, which is 32 on 32-bit targets and 64 on 64-bit targets. The intended element count is 8. As a result, msg_type values from 9 up to the byte size pass the guard and index past the array.

The helper is only invoked from a NET_DBG log statement, so exploitation requires debug logging to be enabled at build time. When triggered, the function returns a garbage const char * that a %s log conversion dereferences. This produces a wild-pointer read and typically crashes the DHCPv4 client. The mismatch is classified as an out-of-bounds read under [CWE-125].

Root Cause

The root cause is confusion between sizeof and ARRAY_SIZE. sizeof(name) yields the byte width of the pointer array, not its element count. The correct macro, ARRAY_SIZE(name), evaluates to 8 and enforces the intended 1..8 acceptance window. The same defective pattern exists in the DHCPv6 helper.

Attack Vector

The msg_type value originates from the DHCP MESSAGE TYPE option and is read as an unchecked raw byte using net_pkt_read_u8(). A DHCP server, or any host able to inject a spoofed DHCP reply onto the client's link, sets this byte to a value greater than 8. The malicious reply drives the index out of bounds and reaches the debug log site.

// Patch: subsys/net/lib/dhcpv4/dhcpv4.c
// net: dhcp: fix bounds check to use ARRAY_SIZE instead of sizeof
 		"decline,"
 	};
 
-	__ASSERT_NO_MSG(state >= 0 && state < sizeof(name));
+	__ASSERT_NO_MSG(state >= 0 && state < ARRAY_SIZE(name));
 	return name[state];
 }

Source: Zephyr commit 73c8a7df

Detection Methods for CVE-2026-10773

Indicators of Compromise

Unexpected crashes or resets of Zephyr-based devices during DHCP lease acquisition or renewal.
DHCPv4 debug log entries containing garbled or non-printable message-type name strings prior to a fault.
Rogue DHCP OFFER or ACK packets carrying MESSAGE TYPE option values greater than 8.

Detection Strategies

Inspect DHCPv4 traffic at the network edge for option 53 values outside the standard 1..8 range defined by RFC 2132.
Audit Zephyr build configurations for CONFIG_NET_DHCPV4_LOG_LEVEL_DBG=y and CONFIG_NET_DHCPV6_LOG_LEVEL_DBG=y, which are the preconditions for reachability.
Correlate device crash telemetry with DHCP transaction timestamps to identify triggered exploitation attempts.

Monitoring Recommendations

Enable DHCP snooping on managed switches to block unauthorized DHCP servers on the L2 segment.
Monitor for the appearance of new DHCP servers on trusted VLANs using ARP and DHCP inventory tools.
Alert on repeated DHCP client restarts from the same embedded device MAC address.

How to Mitigate CVE-2026-10773

Immediate Actions Required

Apply Zephyr commit 73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7, which replaces sizeof(name) with ARRAY_SIZE(name) in both DHCPv4 and DHCPv6 helpers.
Rebuild and reflash affected Zephyr firmware images that ship with DHCP debug logging enabled.
Restrict DHCP service to trusted infrastructure and enable DHCP snooping on adjacent network segments.

Patch Information

The fix is available in the Zephyr project via the GitHub commit and documented in the Zephyr Security Advisory GHSA-r5hq-xq42-wcfq. The patch corrects the bounds check in net_dhcpv4_msg_type_name() and the equivalent DHCPv6 helper.

Workarounds

Disable DHCPv4 debug logging by setting CONFIG_NET_DHCPV4_LOG_LEVEL_DBG=n (and the DHCPv6 equivalent) in the Zephyr build configuration. This removes the only call site that reaches the vulnerable helper.
Enforce DHCP snooping and 802.1X on the access network to prevent rogue DHCP replies from reaching Zephyr clients.
Operate affected devices on isolated management VLANs until firmware containing the fix is deployed.

bash

# Disable DHCPv4 debug logging in prj.conf to eliminate the reachable call site
CONFIG_NET_DHCPV4_LOG_LEVEL_DBG=n
CONFIG_NET_DHCPV6_LOG_LEVEL_DBG=n
# Rebuild firmware after applying commit 73c8a7df
west build -b <board> -p auto