CVE-2026-41285

OVERVIEW CVE-2026-41285 affects OpenBSD through version 7.8 and impacts the slaacd and rad daemons, which handle IPv6 network configuration. The vulnerability exists in the processing of ICMPv6 Neighbor Discovery options and is triggered when a crafted ND option with zero length is received over a local network. The flaw stems from an insufficient input validation check prior to an arithmetic operation (nd_opt_len * 8 - 2) that can result in an infinite loop condition. SEVERITY This vulnerability carries a CVSS 3.1 Medium severity rating of 4.3 with an adjacent network attack vector, low complexity, and no privilege requirements. The attack causes a denial of service through application hang but does not compromise confidentiality or integrity. The EPSS score of 0.00007 indicates extremely low prevalence relative to other CVEs, suggesting limited real-world exploitation likelihood. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability absent from the Known Exploited Vulnerabilities catalog and listed as inactive on the Hot List. No public exploit code has been reported, and community attention remains minimal based on available threat intelligence. Organizations should nevertheless apply patches as they become available to prevent potential local network-based denial of service attacks.