CVE-2026-55606GHSA-x8x4-7gvf-gp45
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
openwrt odhcpdNetwork & edge
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Text from CVE List
Affected versions 1
- odhcpdaffected: <= 25.12CVE List
References 4
- github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57fFixvia CVE List
- github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301Fixvia CVE List
- github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45Advisoryvia CVE List
- github.com/openwrt/odhcpd/pull/401Referencevia CVE List