CVE-2026-53921GHSA-7fwx-hhrg-3496

odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

openwrt odhcpdNetwork & edge

Open in Threatline Record JSON

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-53921 - odhcpd The odhcpd service on OpenWrt routers could be tricked by a specially crafted network packet to write data beyond its intended memory area. Because the servBluesky: CVE posts, 23 Oct 2026

Description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.

Text from CVE List

Affected versions 1

odhcpdaffected: < 25.12CVE List