Read the docs
TI-2026-79904 Aliases CVE-2026-55606

Stack buffer overread in odhcpd DHCPv6 DUID comparison

Priority HIGH 68CWE-126Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenWrt odhcpd in versions 25.12 and prior contains a buffer over-read (CWE-126). Its DHCPv6 self loop detection uses a DUID length in network byte order directly as the memcmp() size, so on little endian hosts memcmp() reads far beyond a 128 byte stack buffer. An unauthenticated remote attacker can trigger a 2560 byte overread with a single DHCPv6 packet.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtodhcpdup to 25.12—No fix listedCNA
  • odhcpd Vendoropenwrt Affected up to 25.12 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for odhcpd.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-55606
  2. 2026-10-24 Priority changed: MEDIUM → LOW
  3. 2026-10-29 CISA SSVC decision points changed
  4. 2026-10-29 Priority changed: LOW → HIGH

References

Other 4

  • TI-2026-79903 Stack buffer overflow in odhcpd DHCPv6 IA reply handling CVSS 3.1CRITICAL 9.8
  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-79901 Use-after-free in odhcpd DHCPv6 IA handling CVSS 4.0HIGH 8.8
  • TI-2026-48502 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info CVSS 4.0HIGH 8.7
  • TI-2026-44407 luci-app-banip Log Monitor IP Extraction Bypass CVSS 4.0HIGH 8.7
  • TI-2026-51067 luci-app-openvpn Path Traversal RCE via instance_name2 CVSS 4.0CRITICAL 9.4
See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences