PT-2026-36009 · Freebsd · Freebsd

Joshua Rogers

·

Published

2026-04-29

·

Updated

2026-05-05

·

CVE-2026-42511

CVSS v3.1

8.1

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FreeBSD dhclient (all supported versions)
Description A flaw exists in how the DHCP client processes network configuration parameters. The BOOTP file field is written to the lease file without escaping embedded double-quotes, which allows the injection of arbitrary dhclient.conf directives. When the lease file is re-parsed by dhclient, such as after a system restart, an attacker-controlled field is passed to the dhclient-script() function, which evaluates it. This enables a rogue DHCP server to execute arbitrary code as root on the affected system.
Recommendations Apply the security patch provided by the FreeBSD Project and reboot the system.

Fix

RCE

Weakness Enumeration

CWE-149

Related Identifiers

CVE-2026-42511

Affected Products

Freebsd