The BOOTP file field is written to the lease file without escaping embedded double-quotes

CVE-2026-42511 is a FreeBSD dhclient injection bug: attacker-controlled BOOTP file and server_name fields are written into the on-disk lease file without escaping embedded quotes, so a malicious DHCP reply can smuggle new dhclient.conf-style directives into lease state. When that poisoned lease is later reparsed, the injected medium value can flow into /sbin/dhclient-script, which uses eval, yielding root code execution. FreeBSD says all supported versions were affected before the fixes in 13.5-RELEASE-p13, 14.3-RELEASE-p12, 14.4-RELEASE-p3, and 15.0-RELEASE-p7.

The vendor's HIGH 8.1 score is technically defensible if you look only at impact, but it overstates enterprise urgency in most fleets because this is not broad internet RCE. The decisive friction is attacker position: they must control or spoof DHCP on the same broadcast domain, or lure the target onto a malicious AP. That sharply narrows exposure for datacenter servers and segmented enterprise LANs, even though the blast radius on a successfully hit host is full root.

Why this verdict

• Downgrade for attacker position: the chain starts with rogue DHCP control on the same L2 segment or a malicious AP, which implies local-network adjacency rather than internet-wide reach.
• Downgrade for exposed population: many enterprise FreeBSD systems are servers, appliances, or infrastructure nodes on managed VLANs or static IPs, so only a subset of deployments ever present this DHCP attack surface.
• Downgrade for threat evidence: no KEV listing, no confirmed active exploitation in reviewed sources, and a very low EPSS all argue against treating this like an emergency patch-everything event.
• Hold at MEDIUM, not LOW: if the attacker can reach the DHCP path once, the end state is full root code execution through a clean privileged sink in dhclient-script.

Why not higher?

If this were unauthenticated internet-reachable service RCE, the vendor's HIGH would stand. But the chain is bottlenecked by network adjacency, DHCP race/control, and deployment reality: this is usually a post-access or hostile-network scenario, not something random internet scanning converts into mass compromise.

Why not lower?

This is still real root RCE with no need for local credentials once the attacker owns the DHCP exchange. Roaming FreeBSD laptops, lab systems, branch gear, and devices on less-controlled access networks are meaningfully exposed, so writing it off as mere hygiene would understate the host-level blast radius.

1. Block rogue DHCP — Turn on DHCP snooping, port security, NAC, or equivalent switch/Wi-Fi protections wherever FreeBSD DHCP clients live. This directly attacks the prerequisite that makes exploitation possible; for a MEDIUM verdict there is no noisgate mitigation SLA, so use this as targeted risk reduction while you work through the normal remediation window.
2. Prioritize untrusted-network clients — Identify FreeBSD laptops, travel systems, lab devices, and branch/edge nodes that regularly join non-datacenter networks. These are the hosts where the attacker-position friction is weakest, so they should move to the front of the patch queue even though the overall fleet verdict is only MEDIUM.
3. Monitor lease and script activity — Add file integrity or EDR watchpoints on /var/db/dhclient.leases.* and process telemetry for dhclient and /sbin/dhclient-script. This will not prevent the bug, but it can surface poisoning attempts or odd root-side command execution during the remediation window.
4. Use static addressing where justified — For sensitive FreeBSD infrastructure that does not need DHCP, moving to static IPs removes the vulnerable path entirely. Do this selectively for crown-jewel systems as an architectural hardening measure, not as a substitute for patching.

Run this on the FreeBSD target host itself as root or with a shell account that can execute freebsd-version; example: sh ./check-cve-2026-42511.sh. It only needs local read/execute access and reports VULNERABLE, PATCHED, or UNKNOWN based on the installed FreeBSD release patchlevel.

#!/bin/sh
# check-cve-2026-42511.sh
# Purpose: Determine likely exposure to CVE-2026-42511 on FreeBSD release systems.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -eu

get_ver() {
  if command -v freebsd-version >/dev/null 2>&1; then
    freebsd-version -u 2>/dev/null || freebsd-version -k 2>/dev/null || freebsd-version 2>/dev/null || true
  else
    uname -r 2>/dev/null || true
  fi
}

VER="$(get_ver | head -n1 | tr -d '\r')"

if [ -z "$VER" ]; then
  echo "UNKNOWN: could not determine FreeBSD version"
  exit 2
fi

# Known fixed release patchlevels from FreeBSD-SA-26:12.dhclient
# 13.5-RELEASE-p13
# 14.3-RELEASE-p12
# 14.4-RELEASE-p3
# 15.0-RELEASE-p7

case "$VER" in
  *STABLE*|*CURRENT*|*ALPHA*|*BETA*|*RC* )
    echo "UNKNOWN: non-RELEASE build detected ($VER); verify source update includes FreeBSD-SA-26:12.dhclient"
    exit 2
    ;;
esac

# Parse forms like 14.4-RELEASE-p3 or 13.5-RELEASE
BASE="${VER%%-RELEASE*}"
PATCH=0
case "$VER" in
  *-RELEASE-p* ) PATCH="${VER##*-RELEASE-p}" ;;
  *-RELEASE* ) PATCH=0 ;;
  * )
    echo "UNKNOWN: unrecognized version format ($VER)"
    exit 2
    ;;
esac

# Keep numeric part only
PATCH="$(printf '%s' "$PATCH" | sed 's/[^0-9].*$//')"
[ -n "$PATCH" ] || PATCH=0

is_patched=1
case "$BASE" in
  13.5)
    [ "$PATCH" -ge 13 ] && is_patched=0 || is_patched=1
    ;;
  14.3)
    [ "$PATCH" -ge 12 ] && is_patched=0 || is_patched=1
    ;;
  14.4)
    [ "$PATCH" -ge 3 ] && is_patched=0 || is_patched=1
    ;;
  15.0)
    [ "$PATCH" -ge 7 ] && is_patched=0 || is_patched=1
    ;;
  *)
    echo "UNKNOWN: version $VER is outside the advisory's explicit release mapping"
    exit 2
    ;;
esac

if [ "$is_patched" -eq 0 ]; then
  echo "PATCHED: $VER meets or exceeds the FreeBSD-SA-26:12.dhclient fixed patchlevel"
  exit 0
else
  echo "VULNERABLE: $VER is below the FreeBSD-SA-26:12.dhclient fixed patchlevel"
  exit 1
fi

Sources

1. FreeBSD advisory mirror with full advisory text
2. NVD CVE record
3. AISLE technical write-up
4. FreeBSD fixing commit message (stable/14 mirror)
5. Ubuntu CVE page
6. Debian security tracker
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation