The FreeBSD Project disclosed and patched a vulnerability in its default IPv4 DHCP client on April 29, 2026, warning that a rogue DHCP server may be able to execute arbitrary code as root on an affected system. Tracked as CVE-2026-42511, the flaw affects dhclient in all FreeBSD versions supported at the time of disclosure.
An attacker must be on the same broadcast domain as the target and able to respond to its DHCP requests. Exploitation depends on malicious DHCP data being stored in a lease file and subsequently re-parsed by dhclient, for example after a system restart.
Systems that do not run dhclient are not affected. The project credited Joshua Rogers of the AISLE Research Team with reporting the vulnerability.
How the lease-file flaw works
FreeBSD’s advisory describes a failure to escape embedded double quotes when writing the BOOTP file field from a DHCP response into the lease file. This allows an attacker to inject arbitrary dhclient.conf directives into the stored data.
When dhclient later re-parses that file, an attacker-controlled value can be passed to dhclient-script, which evaluates it. The advisory identifies possible arbitrary code execution as root as the resulting impact.
The associated code change explains that an injected medium directive can reach the script’s eval operation. The patch adds checks that reject leases whose server-name or boot-filename fields contain double quotes or backslashes.
Corrected versions and update paths
The advisory lists fixes in 15.0-RELEASE-p7, 14.4-RELEASE-p3, 14.3-RELEASE-p12 and 13.5-RELEASE-p13. It also records April 29 corrections for 15.0-STABLE, 14.4-STABLE and 13.5-STABLE.
The FreeBSD Project directs affected systems to a supported stable or release security branch dated after the relevant correction time. Available update methods depend on the release, hardware platform and installation model.
FreeBSD 15.0-RELEASE systems on amd64 or arm64 installed using base system packages can receive the update through pkg. Release systems installed from binary distribution sets can use freebsd-update on amd64 and arm64, or on i386 when running FreeBSD 13.
For source-based updates, the advisory describes verifying the patch’s detached PGP signature, applying the patch, and rebuilding and installing the operating system. That procedure also calls for restarting the applicable daemons or rebooting.
Workaround limits and network controls
FreeBSD states that no workaround is available for the vulnerability. Separately, its advisory identifies DHCP snooping on switches as a network control to prevent rogue DHCP servers from operating.
The distinction reflects the attack conditions: DHCP snooping addresses an attacker’s ability to supply malicious responses, while the software patch corrects dhclient’s handling of the received fields.
