Critical Vulnerabilities in SUSE Wicked Affecting DHCP Parsing

• •CVE-2026-71401 and CVE-2026-71402 are critical vulnerabilities in SUSE Wicked.
• •Affected systems include SUSE Linux Enterprise and openSUSE versions.
• •Immediate patching is recommended to mitigate potential exploitation risks.

SUSE has released important security updates addressing two critical vulnerabilities in the Wicked network management tool, identified as CVE-2026-71401 and CVE-2026-71402, both published on 2026-08-27. These vulnerabilities involve out-of-bounds reads due to IP length underflow and improper handling of DHCP options, potentially allowing attackers to exploit these flaws for unauthorized access or denial of service. The affected systems include various versions of SUSE Linux Enterprise and openSUSE. The updates are crucial for preventing potential exploits that could lead to significant security breaches. Administrators are advised to apply the patches immediately using the recommended installation methods. The vulnerabilities have been rated with CVSS scores indicating a high severity level, emphasizing the urgency of remediation. Current reports indicate that there is no confirmed active exploitation in the wild, but the potential risk remains significant.