CVE-2026-41285 MEDIUM

CVE-2026-41285

Vendor Openbsd
Product OpenBSD
Weakness CWE-1284
Published April 20, 2026
Last update April 21, 2026

CVSS base score

4.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.

Key dates

02Disclosure timeline

April 20, 2026 CVE published
April 21, 2026 Record updated