CVE-2026-46433

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.5 / 10

Vector String

                                        CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H                                    

Vulnerability Description

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Vulnerability Details

Published Date

June 09, 2026

Last Modified

June 11, 2026

CWE ID

CWE-125

Source

NVD

Vendor

lldpd

Product

lldpd

External References

https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6
https://github.com/lldpd/lldpd/pull/787
https://github.com/lldpd/lldpd/releases/tag/1.0.22
https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3

CVE-2026-46433

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment