CVE intelligence

CVE-2026-56116

Vulnerability intelligence

Published Jun 23, 2026Sources checked Nov 12, 2026

6.5MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2026-56116 and is rated Medium severity with a CVSS score of 6.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Jul 6, 2026

CBL-Mariner Releases

Vendor-listed releases

10.0.8-2

CISA KEVNot listedBased on the latest collected catalog

EPSS0.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-56116?

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements.

Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

Source: NVD