# OpenBSD 8.0 Released With PF Firewall Hardening and Critical Vulnerability Fixes (incl. IPsec AES-GMAC Kernel Heap Overflow Erratum 003, CVE-2026-31912)

> OpenBSD 8.0 (61st release, 2026-10-20) fixes security issues in PF, bpf(4), httpd, relayd, iked, DHCP and bundled libexpat 2.8.4. Errata 003 fixes a remotely triggerable kernel heap overflow when IPsec uses AES-GMAC on amd64 (AES-NI) and octeon systems. No in-the-wild exploitation, public PoC, or KEV listing is reported.

- **Published:** 2026-10-26T21:22:50Z
- **Last reviewed:** 2026-10-26T21:22:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4490
- **ID:** TL-2026-4490
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31912, CVE-2026-66046, CVE-2026-76641, CVE-2026-76957

## Description

OpenBSD 8.0, the 61st release, shipped on 2026-10-20 with a broad set of hardening changes and security fixes, and a patch-advisory-style set of errata published the same day.

Kernel / IPsec (Errata 003, 2026-10-20, patch 003_aesgmac.patch.sig): when IPsec is used with AES-GMAC, a kernel heap overflow can be triggered remotely. Only amd64 systems with AES-NI (sys/arch/amd64/amd64/aesni.c) and octeon systems with the crypto coprocessor (sys/arch/octeon/dev/octcrypto.c) are affected; AES-GCM is not. Per the patch, the driver sized its buffer from the encrypted-data length only, but wrote additional authenticated data (AAD, plus 4 bytes when ESN is used) into it; when AAD exceeds the data length the buffer is overrun. The fix allocates MAX(crd_len, aadlen). The errata page lists no CVE for this issue.

Packet filtering and network stack: PF fixes include an off-by-one in the DIOCIGETIFACES ioctl, rejection of un-terminated strings in pf(4) ioctls, an out-of-bounds read in pf_rule_copyin(), a NULL pointer dereference in outbound paths, a connection-counter race, and protection against crafted TCP reset packets disrupting connections. bpf(4) received hardening: detection of out-of-bounds reads from an int overflow in the bpf_mem backends, bpf_validate blocking of unhandled instructions, and program bound checks linked to libpcap CVE-2026-31912 (NVD: CVSS 3.1 5.5 MEDIUM, AV:L/PR:L, CWE-125/823/1285, libpcap before 1.10.7 BPF interpreter fails to detect the end of the filter program buffer or validate jump offsets).

Network daemons: httpd rejects ambiguous CL.TE framing (RFC 9112) and enforces a maximum body for chunked FastCGI requests; relayd rejects duplicate Content-Length and obs-fold headers; iked rejects malformed or out-of-state IKEv2 messages and adds bounds checks; isakmpd fixes a NULL dereference and validates DELETE payloads/proposal sizes; dhcpd and dhcpleased gain input validation against crashes and memory exhaustion via DHCPINFORM.

Third-party components: libexpat 2.8.4 addresses CVE-2026-66046 (quadratic complexity in storeAtts, CVSS 3.1 7.5, CWE-407), CVE-2026-76641 (out-of-bounds read via struct size mismatch with external entity parsers, CVSS 3.1 7.5, CWE-125) and CVE-2026-76957 (use-after-free from missing handler call depth tracking with custom encoding callbacks, CVSS 3.1 7.8, CWE-416). The release also carries Perl fixes (CVE-2026-57433, CVE-2026-57432, CVE-2026-13221), NSD fixes (CVE-2026-12244, -12245, -12246, -12490; errata 002), OpenSSH 10.6 and LibreSSL 4.4.0. Other errata: 001 PPP off-by-one (reliability), 004 video driver memory issues, 005 certificate database update (2026-10-23).

This is a patch advisory, not an active campaign. Systems are updated with syspatch (binary) or source patches on other architectures.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Application or System Exploitation

## Sources

- [OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes](https://gbhackers.com/openbsd-8-0-released/)
- [OpenBSD 8.0 release page](https://www.openbsd.org/80.html)
- [OpenBSD 8.0 errata](https://www.openbsd.org/errata80.html)
- [Errata 003 patch: IPsec AES-GMAC heap overflow](https://ftp.openbsd.org/pub/OpenBSD/patches/8.0/common/003_aesgmac.patch.sig)
- [NVD CVE-2026-31912 (libpcap BPF bounds)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-31912)
- [libpcap fix commit for CVE-2026-31912](https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9)
- [NVD CVE-2026-66046 (libexpat storeAtts quadratic complexity)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-66046)
- [VulnCheck: expat DoS via storeAtts quadratic complexity](https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity)
- [NVD CVE-2026-76641 (libexpat out-of-bounds read)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76641)
- [NVD CVE-2026-76957 (libexpat use-after-free)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76957)
- [libexpat PR 1322 (handler depth tracking fix)](https://github.com/libexpat/libexpat/pull/1322)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4490