High severity7.5NVD Advisory· Published Mar 25, 2022· Updated Jun 17, 2026

CVE-2022-27882

Description

slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenBSD/OpenBSD3 versions
cpe:2.3:o:openbsd:openbsd:6.9:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:openbsd:openbsd:6.9:*:*:*:*:*:*:*
- cpe:2.3:o:openbsd:openbsd:7.0:*:*:*:*:*:*:*
- (no CPE)range: < 2022-03-22
OpenBSD/slaacddescription
OpenBSD/slaacdllm-fuzzy
Range: < 2022-03-22

Patches

Vulnerability mechanics

References

ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/033_slaacd.patch.signvdPatchRelease NotesVendor Advisory
ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/017_slaacd.patch.signvdPatchRelease NotesVendor Advisory
blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.htmlnvdExploitThird Party Advisory
security.netapp.com/advisory/ntap-20220506-0005/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000