Stack buffer overflow in odhcpd DHCPv6 IA reply handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
odhcpd, the DHCPv6, DHCPv4 and router-advertisement server used by OpenWrt, is affected before version 25.12. Its DHCPv6 IA response handler writes past a fixed 512-byte stack buffer when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space (CWE-121). Two independent overflow sites in the same call chain are reachable over the network through one unauthenticated UDP packet. Because odhcpd runs as root on OpenWrt, the overflow can lead to code execution.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update odhcpd to version 25.12, where this issue is patched.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA odhcpd (openwrt) Fixed in 25.12
Timeline
- 2026-10-23 Threatist record created from CVE-2026-53921
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → HIGH
References
Other 7
- https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
- https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03
- https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3
- https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9
- https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a
- https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7
- https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328
More openwrt vulnerabilities
- TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
- TI-2026-79901 Use-after-free in odhcpd DHCPv6 IA handling CVSS 4.0HIGH 8.8
- TI-2026-48502 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info CVSS 4.0HIGH 8.7
- TI-2026-44407 luci-app-banip Log Monitor IP Extraction Bypass CVSS 4.0HIGH 8.7
- TI-2026-51067 luci-app-openvpn Path Traversal RCE via instance_name2 CVSS 4.0CRITICAL 9.4
- TI-2026-44983 Cross-site scripting in openwrt CVSS 3.1CRITICAL 9.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences