CVE-2026-46433 Details
Description
lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.
A heap buffer over-read vulnerability has been identified in lldpd, an implementation of IEEE 802.1ab (LLDP), prior to version 1.0.22. The issue arises in the lldpd_decode() function, where 802.1Q VLAN tags are removed from received Ethernet frames. The vulnerability occurs because the function incorrectly calculates the byte count for the memmove() operation, leading to a 4-byte over-read past the allocated buffer when the frame size matches the interface MTU. This flaw can be exploited by sending VLAN-tagged LLDP frames on the same broadcast domain, causing a denial-of-service condition by crashing the application when using AddressSanitizer.
Users can upgrade to lldpd version 1.0.22 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6 | [email protected] | Patch |
| https://github.com/lldpd/lldpd/pull/787 | [email protected] | Issue TrackingPatch |
| https://github.com/lldpd/lldpd/releases/tag/1.0.22 | [email protected] | ProductRelease Notes |
| https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lldpd project lldpd | < 1.0.22 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |