The FreeBSD Project has issued a critical security advisory (FreeBSD-SA-26:12.dhclient) to address a severe Remote Code Execution (RCE) vulnerability in its default IPv4 DHCP client.
Tracked as CVE-2026-42511, this flaw allows local network attackers to execute arbitrary code with root privileges. Discovered by Joshua Rogers of the AISLE Research Team, the vulnerability affects all supported versions of FreeBSD.
The security flaw originates in how the dhclient(8) utility handles malicious DHCP lease options. Specifically, the vulnerability is triggered when the BOOTP file field is written to the system’s lease file.
Because the software fails to escape embedded double-quotes during this process properly, threat actors can inject arbitrary directives directly into dhclient.conf file.
The malicious payload remains dormant until the DHCP lease file is re-parsed, which typically occurs during a system restart or network interface initialization.
When re-parsed, the attacker-controlled field is passed directly to the dhclient-script(8) service, which evaluates and executes the injected code.
To successfully exploit CVE-2026-42511, an attacker must be positioned on the same local broadcast domain as the target.
By deploying a rogue DHCP server, the attacker can intercept legitimate DHCP requests and reply with the maliciously crafted BOOTP file field.
If successful, this attack vector results in complete system compromise. The injected code executes with root permissions, allowing the threat actor to install persistence mechanisms, deploy malware, or pivot laterally within the compromised network.
Affected Versions
The vulnerability affects multiple supported FreeBSD branches. Systems running the following versions are at risk if they actively use the dhclient service:
Note: Systems that do not utilize dhclient(8) for network configuration are not affected by this vulnerability.
Currently, there is no direct software workaround for systems relying on dhclient. However, administrators can implement network-level defenses.
Configuring DHCP snooping on managed network switches will effectively block rogue DHCP servers from operating, nullifying the attack vector.
The FreeBSD Project strongly urges administrators to apply the latest security patches immediately. Depending on your system configuration, use one of the following methods:
1. Binary Updates
For standard releases, fetch and install the binary patches using the built-in update tool:
# freebsd-update fetch
# freebsd-update install
2. Package Updates
For environments utilizing base system packages, upgrade via the package manager:
# pkg upgrade -r FreeBSD-base
Following the update, administrators must reboot the system or restart the applicable networking daemons to ensure the patch is applied and any previously poisoned lease files are neutralized.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…