Read the docs
TI-2026-79901 Aliases CVE-2026-53918

Use-after-free in odhcpd DHCPv6 IA handling

Priority HIGH 77CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

odhcpd, the DHCPv6, DHCPv4 and router advertisement server used by OpenWrt, is affected before 25.12. Its DHCPv6 IA handler (CWE-416) can free a lease that is still referenced, so a later IA in the same packet reads freed memory. An unauthenticated attacker on an adjacent network can send a crafted DHCPv6 REQUEST to cause denial of service and to confuse the DHCPv6 Reconfigure key.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00619 49th percentileScored 2026-11-07
Fix Fixed odhcpd (openwrt): 25.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtodhcpdbefore 25.1225.12Patch availableCNA
  • odhcpd Vendoropenwrt Affected before 25.12 Fixed in 25.12 Patch available CNA

Remediation

Upgrade odhcpd to version 25.12, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA odhcpd (openwrt) Fixed in 25.12

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-53918
  2. 2026-10-24 Priority changed: MEDIUM → LOW
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-79903 Stack buffer overflow in odhcpd DHCPv6 IA reply handling CVSS 3.1CRITICAL 9.8
  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-48502 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info CVSS 4.0HIGH 8.7
  • TI-2026-44407 luci-app-banip Log Monitor IP Extraction Bypass CVSS 4.0HIGH 8.7
  • TI-2026-51067 luci-app-openvpn Path Traversal RCE via instance_name2 CVSS 4.0CRITICAL 9.4
  • TI-2026-44983 Cross-site scripting in openwrt CVSS 3.1CRITICAL 9.6
See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences