High severity7.5NVD Advisory· Published Mar 25, 2022· Updated Jun 17, 2026

CVE-2022-27881

Description

engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenBSD/OpenBSD2 versions
cpe:2.3:a:openbsd:openbsd:6.9:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openbsd:openbsd:6.9:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openbsd:7.0:*:*:*:*:*:*:*
OpenBSD/slaacddescription
OpenBSD/slaacdllm-fuzzy
Range: <=2022-02-21 (for 6.9 and 7.0)

Patches

Vulnerability mechanics

References

ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.signvdPatchRelease NotesVendor Advisory
ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/014_slaacd.patch.signvdPatchRelease NotesVendor Advisory
blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.htmlnvdExploitPatchThird Party Advisory
security.netapp.com/advisory/ntap-20220506-0005/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000