All vulnerabilities
CVE-2026-86296

D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow

D-Link DIR-822ANetwork & edge
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 8 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.70%Chance of exploitation activity in the next 30 days, higher than 77% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published7 Sep 2026Updated 8 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 7 Sep 2026, 10:30 UTCPublishedCVE List
  2. 19 Oct 2026, 13:05 UTCExploit code publicBluesky: zero-day

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Text from CVE List

Affected versions 1

  • DIR-822Aaffected: A_101CVE List

References 6