Vulnerability Details CVE-2026-56099
OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 27.6%
CVSS Severity
CVSS v3 Score 5.3
References
- https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd
- https://pop.argus-systems.ai/advisory/adv-040.html
- https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input
- http://seclists.org/fulldisclosure/2026/Jun/17
- http://www.openwall.com/lists/oss-security/2026/06/19/3
Products affected by CVE-2026-56099
-
cpe:2.3:o:openbsd:openbsd:-
-
cpe:2.3:o:openbsd:openbsd:2.0
-
cpe:2.3:o:openbsd:openbsd:2.1
-
cpe:2.3:o:openbsd:openbsd:2.2
-
cpe:2.3:o:openbsd:openbsd:2.3
-
cpe:2.3:o:openbsd:openbsd:2.4
-
cpe:2.3:o:openbsd:openbsd:2.5
-
cpe:2.3:o:openbsd:openbsd:2.6
-
cpe:2.3:o:openbsd:openbsd:2.7
-
cpe:2.3:o:openbsd:openbsd:2.8
-
cpe:2.3:o:openbsd:openbsd:2.9
-
cpe:2.3:o:openbsd:openbsd:3.0
-
cpe:2.3:o:openbsd:openbsd:3.1
-
cpe:2.3:o:openbsd:openbsd:3.2
-
cpe:2.3:o:openbsd:openbsd:3.3
-
cpe:2.3:o:openbsd:openbsd:3.4
-
cpe:2.3:o:openbsd:openbsd:3.5
-
cpe:2.3:o:openbsd:openbsd:3.6
-
cpe:2.3:o:openbsd:openbsd:3.7
-
cpe:2.3:o:openbsd:openbsd:3.8
-
cpe:2.3:o:openbsd:openbsd:3.9
-
cpe:2.3:o:openbsd:openbsd:4.0
-
cpe:2.3:o:openbsd:openbsd:4.1
-
cpe:2.3:o:openbsd:openbsd:4.2
-
cpe:2.3:o:openbsd:openbsd:4.3
-
cpe:2.3:o:openbsd:openbsd:4.4
-
cpe:2.3:o:openbsd:openbsd:4.5
-
cpe:2.3:o:openbsd:openbsd:4.6
-
cpe:2.3:o:openbsd:openbsd:4.7
-
cpe:2.3:o:openbsd:openbsd:4.8
-
cpe:2.3:o:openbsd:openbsd:4.9
-
cpe:2.3:o:openbsd:openbsd:5.0
-
cpe:2.3:o:openbsd:openbsd:5.1
-
cpe:2.3:o:openbsd:openbsd:5.2
-
cpe:2.3:o:openbsd:openbsd:5.3
-
cpe:2.3:o:openbsd:openbsd:5.4
-
cpe:2.3:o:openbsd:openbsd:5.5
-
cpe:2.3:o:openbsd:openbsd:5.6
-
cpe:2.3:o:openbsd:openbsd:5.7
-
cpe:2.3:o:openbsd:openbsd:5.8
-
cpe:2.3:o:openbsd:openbsd:5.9
-
cpe:2.3:o:openbsd:openbsd:6.0
-
cpe:2.3:o:openbsd:openbsd:6.1
-
cpe:2.3:o:openbsd:openbsd:6.2
-
cpe:2.3:o:openbsd:openbsd:6.3
-
cpe:2.3:o:openbsd:openbsd:6.4
-
cpe:2.3:o:openbsd:openbsd:6.5
-
cpe:2.3:o:openbsd:openbsd:6.6
-
cpe:2.3:o:openbsd:openbsd:6.7
-
cpe:2.3:o:openbsd:openbsd:6.9
-
cpe:2.3:o:openbsd:openbsd:7.0
-
cpe:2.3:o:openbsd:openbsd:7.1
-
cpe:2.3:o:openbsd:openbsd:7.2
-
cpe:2.3:o:openbsd:openbsd:7.3
-
cpe:2.3:o:openbsd:openbsd:7.4
-
cpe:2.3:o:openbsd:openbsd:7.5
-
cpe:2.3:o:openbsd:openbsd:7.6
-
cpe:2.3:o:openbsd:openbsd:8.0