CVE-2026-46433

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

• CWE-125

• https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6Patch
• https://github.com/lldpd/lldpd/pull/787Issue Tracking, Patch
• https://github.com/lldpd/lldpd/releases/tag/1.0.22Product, Release Notes
• https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3Vendor Advisory

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46427Budibase is an open-source low-code platform. Prior to 3.38.…7.7
• CVE-2026-46428lettre is a a mailer library for Rust. Starting in version 0…9.1
• CVE-2026-4643Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to…3.5
• CVE-2026-46430Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46431Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46432LMDeploy is a toolkit for compressing, deploying, and servin…7.8
• CVE-2026-46440Flowise is a drag & drop user interface to build a customize…9.1
• CVE-2026-46441Flowise is a drag & drop user interface to build a customize…9.6
• CVE-2026-46442Flowise is a drag & drop user interface to build a customize…9.9
• CVE-2026-46443Flowise is a drag & drop user interface to build a customize…6.5
• CVE-2026-46444Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-46445SOGo before 5.12.7, when PostgreSQL is used, allows SQL inje…7.1