OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd Patch
- https://pop.argus-systems.ai/advisory/adv-040.html Exploit, Patch, Third Party Advisory
- http://seclists.org/fulldisclosure/2026/Jun/17 Exploit, Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/06/19/3 Exploit, Mailing List, Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · openbsdNVD modified 2026-10-26 11:10
Affected (CPE criteria) 1
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*
References 5
- https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd Patch
- https://pop.argus-systems.ai/advisory/adv-040.html Exploit, Patch, Third Party Advisory
- https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input Third Party Advisory
- http://seclists.org/fulldisclosure/2026/Jun/17 Exploit, Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/06/19/3 Exploit, Mailing List, Patch, Third Party Advisory