Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-09T22:49:02 lldpd: lldpd: Denial of Service due to heap buffer over-read when processing VLAN-tagged Ethernet frames 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-131

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

A flaw was found in lldpd, an implementation of IEEE 802.1ab (LLDP). A remote attacker on the adjacent network can send specially crafted Ethernet frames with 802.1Q VLAN (Virtual Local Area Network) tags. This can cause a 4-byte heap buffer over-read, leading to a denial of service (DoS) due to an application crash. This vulnerability occurs when the received frame size equals the interface Maximum Transmission Unit (MTU).

Red Hat Enterprise Linux 10 Fix deferred lldpd Red Hat Enterprise Linux 8 Fix deferred lldpd Red Hat Enterprise Linux 9 Fix deferred lldpd https://www.cve.org/CVERecord?id=CVE-2026-46433 https://nvd.nist.gov/vuln/detail/CVE-2026-46433 https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6 https://github.com/lldpd/lldpd/pull/787 https://github.com/lldpd/lldpd/releases/tag/1.0.22 https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3