CVE-2026-46433: lldpd Buffer Overflow Vulnerability

CVE-2026-46433 Overview

CVE-2026-46433 is a heap out-of-bounds read vulnerability in lldpd, an open-source implementation of the IEEE 802.1ab Link Layer Discovery Protocol (LLDP). The flaw resides in the lldpd_decode() function within src/daemon/lldpd.c, which strips 802.1Q VLAN tags from received Ethernet frames. An incorrect byte count passed to memmove() causes a 4-byte read past the bounds of a malloc(h_mtu) allocation when the received frame size equals the interface Maximum Transmission Unit (MTU). The issue is fixed in version 1.0.22.

Critical Impact
An adjacent-network attacker can send a crafted VLAN-tagged Ethernet frame to trigger a heap out-of-bounds read in lldpd, potentially crashing the daemon and disrupting LLDP-based network discovery [CWE-125].

Affected Products

lldpd versions prior to 1.0.22
Linux and Unix systems running the lldpd daemon for LLDP neighbor discovery
Network appliances and switches bundling lldpd for topology advertisement

Discovery Timeline

2026-06-09 - CVE-2026-46433 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46433

Vulnerability Analysis

The lldpd daemon receives raw Ethernet frames on configured interfaces and decodes them in lldpd_decode(). When a frame contains an 802.1Q VLAN tag, the daemon strips the 4-byte tag by shifting the remaining payload left using memmove(). The source code computes the byte count to move as s - 2 * ETHER_ADDR_LEN, where s is the total frame size. This count incorrectly includes the 4 VLAN tag bytes themselves, so the copy reads 4 bytes past the end of the source frame buffer.

The buffer is allocated with malloc(h_mtu), sized to the interface MTU. When an attacker sends a frame whose length exactly matches the MTU, the over-read crosses the allocation boundary into adjacent heap memory. This can crash the daemon through a SIGSEGV or trigger heap corruption diagnostics under hardened allocators.

Root Cause

The root cause is an off-by-four length miscalculation in the VLAN decapsulation path. The memmove() call should copy s - 2 * ETHER_ADDR_LEN - 4 bytes to account for the removed VLAN tag, not s - 2 * ETHER_ADDR_LEN. The defect is a classic boundary condition error [CWE-125] in length arithmetic.

Attack Vector

Exploitation requires the ability to inject Ethernet frames onto a network segment where lldpd is listening. The attacker crafts an 802.1Q VLAN-tagged frame sized at the target interface MTU and sends it to the LLDP multicast address. No authentication or user interaction is required. Impact is limited to availability, as the read does not yield data to the attacker and integrity is unaffected.

		/* VLAN decapsulation means to shift 4 bytes left the frame from
		 * offset 2*ETHER_ADDR_LEN */
		memmove(frame + 2 * ETHER_ADDR_LEN, frame + 2 * ETHER_ADDR_LEN + 4,
-		    s - 2 * ETHER_ADDR_LEN);
+		    s - 2 * ETHER_ADDR_LEN - 4);
		s -= 4;
	}

Source: GitHub Commit ca931be — The patch subtracts the 4-byte VLAN tag length from the memmove() byte count, preventing the read from exceeding the allocated buffer.

Detection Methods for CVE-2026-46433

Indicators of Compromise

Unexpected lldpd process crashes or restarts with SIGSEGV in system logs
AddressSanitizer or glibc heap diagnostics reporting an out-of-bounds read in lldpd_decode()
Repeated arrival of MTU-sized 802.1Q tagged frames addressed to the LLDP multicast group 01:80:c2:00:00:0e

Detection Strategies

Audit installed lldpd versions across Linux hosts and network appliances and flag any release earlier than 1.0.22
Monitor journalctl -u lldpd and dmesg for segmentation faults, abnormal exits, or systemd restart loops affecting the daemon
Inspect packet captures on management VLANs for anomalous frame sizes at the interface MTU carrying 802.1Q headers

Monitoring Recommendations

Enable core dump collection for the lldpd process to capture crash artifacts for forensic analysis
Forward host syslog and packet capture metadata to a centralized analytics platform to correlate daemon restarts with adjacent network activity
Track LLDP neighbor table stability as sudden loss of neighbors may indicate daemon instability caused by malformed frames

How to Mitigate CVE-2026-46433

Immediate Actions Required

Upgrade lldpd to version 1.0.22 or later on all affected hosts and appliances
Identify any embedded or vendor-distributed builds of lldpd and apply vendor-provided updates that incorporate commit ca931be
Restrict LLDP processing to trusted management interfaces and disable it on untrusted access ports

Patch Information

The upstream fix is available in the lldpd 1.0.22 release and the corresponding GitHub Pull Request #787. Additional context is published in the GHSA-2g8p-2h3j-63m3 advisory. Distribution maintainers should backport commit ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6 to supported branches.

Workarounds

Disable lldpd on interfaces that do not require LLDP neighbor discovery using the configure system interface pattern directive
Apply Layer 2 ingress filtering on switch ports to block 802.1Q tagged frames from untrusted endpoints where VLAN trunking is not expected
Segment management networks so that only authorized devices can transmit to the LLDP multicast address

bash

# Verify installed lldpd version
lldpd -v

# Restrict lldpd to specific trusted interfaces via lldpd.conf
echo 'configure system interface pattern eth0,eth1' | sudo tee -a /etc/lldpd.conf

# Restart the daemon to apply configuration
sudo systemctl restart lldpd