FKIE_CVE-2026-46433

Vulnerability from fkie_nvd - Published: 2026-06-09 23:16 - Updated: 2026-07-23 09:10
Severity
6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.
References
security-advisories@github.comhttps://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6Patch
security-advisories@github.comhttps://github.com/lldpd/lldpd/pull/787Issue Tracking, Patch
security-advisories@github.comhttps://github.com/lldpd/lldpd/releases/tag/1.0.22Product, Release Notes
security-advisories@github.comhttps://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3Vendor Advisory
Impacted products
Vendor Product Version
lldpd_project lldpd *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "lldpd",
          "vendor": "lldpd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.22"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lldpd_project:lldpd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDD2CB1A-89DE-492A-B447-67FAAE9FC9A9",
              "versionEndExcluding": "1.0.22",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22."
    },
    {
      "lang": "es",
      "value": "lldpd es una implementaci\u00f3n de IEEE 802.1ab (LLDP). Antes de la versi\u00f3n 1.0.22, lldpd_decode() en src/daemon/lldpd.c elimina las etiquetas VLAN 802.1Q de las tramas Ethernet recibidas al llamar a memmove() para desplazar la carga \u00fatil de la trama 4 bytes a la izquierda. El tercer argumento (recuento de bytes) es s - 2 * ETHER_ADDR_LEN pero deber\u00eda ser s - 2 * ETHER_ADDR_LEN - 4, causando una lectura excesiva de b\u00fafer de pila de 4 bytes m\u00e1s all\u00e1 de la asignaci\u00f3n malloc(h_mtu) cuando el tama\u00f1o de la trama recibida es igual a la MTU de la interfaz. Este problema ha sido parcheado en la versi\u00f3n 1.0.22."
    }
  ],
  "id": "CVE-2026-46433",
  "lastModified": "2026-07-23T09:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46433",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-10T18:12:17.598816Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T23:16:59.437",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/lldpd/lldpd/pull/787"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/lldpd/lldpd/releases/tag/1.0.22"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.