CVE-2026-102720

/// Technical description

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a

kilobyte past the end of the received message.

The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:

```c

/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */

while (i < length - 1)

{

...

size = *(++data); /* data moves 1: type -> length byte */

data += size + 1; /* data moves size + 1 more */

i += size + 1; /* i moves only size + 1 */

}

```

A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so

the offset falls one byte behind the real read position for every option the walk skips. After

enough skipped options the check `i < length - 1` still holds while `data` is already past the end

of the message, and the subsequent read of the type and length bytes comes from whatever follows.

A single OFFER carrying a long run

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References