Summary: The DHCPv6 vendor option parser in iscsiuio calls strlen() on raw network-received data with no NUL-terminator guarantee, causing an unbounded heap read. The result is used for a 1-byte NUL OOB write and an strcpy that corrupts the iSCSI initiator name with heap-derived data.

Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/apps/dhcpc/dhcpv6.c, dhcpv6_parse_vendor_option() (line 480).

Vulnerability Details:

dhcpv6_parse_vendor_option() at line 495 calls:
  data_len = strlen((char *)data)

where data points to raw network-received bytes from a DHCPv6 Vendor-Specific Information option (type 17), sub-option 203 (iSCSI initiator name). No NUL terminator is guaranteed. strlen() walks past the buffer into adjacent heap memory.

The returned length is then used for:
1. data[data_len] = '\0' at line 509 — 1-byte heap OOB write (NUL byte). data_len cap at ISCSI_MAX_ISCSI_NAME_LENGTH (128) limits offset but does NOT prevent strlen from reading arbitrarily far.
2. strcpy(context->initiatorName, (char *)data) at line 510 — copies up to 128 bytes of heap-derived data into the iSCSI initiator name, corrupting iSCSI identity configuration.

This bug is distinct from CVE-2026-18727 (integer underflow in ipv6_udp_handle_dhcp). This is in dhcpv6_parse_vendor_option() — completely different function and code path.

Attack preconditions: dhcpv6_state must be DHCPV6_STATE_SOLICIT_SENT (timing window during DHCPv6 boot, reliably reachable every boot). Attacker controls VENDOR_CLASS option to match dhcp_vendor_id. L2-adjacent access required.

Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 163 in strlen, called from dhcpv6_parse_vendor_option.

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H - 8.3
C:H — strlen walks heap arbitrarily; strcpy copies heap data into named buffer
I:L — strcpy into initiatorName corrupts iSCSI identity; NUL write can corrupt heap metadata
A:H — reliable crash from OOB read or heap corruption

Proposed Fix: Replace strlen() with strnlen() bounded by the option's declared length.

Upstream status: No fix exists. No upstream commit touches dhcpv6_parse_vendor_option().
Acknowledgement: Red Hat Product Security