Suse Wicked vulnerabilities

3 CVEs affecting Suse Wicked, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71402, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-44932, published 2026-06-16. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
CVE-2026-71401, published 2026-08-27. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as…
CVE-2026-71402, published 2026-08-27. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length…