Stack Buffer Overflow in OpenWrt's DHCP Server
CVE-2026-53921

9.8CRITICAL

Key Information:

Vendor

Openwrt

Status
Odhcpd
Vendor
CVE Published:
23 October 2026

Badges

📰 News Worthy

What is CVE-2026-53921?

odhcpd, the DHCP server used by OpenWrt, features a critical stack buffer overflow vulnerability stemming from the IA response handler in DHCPv6 requests. This flaw allows an unauthenticated user to potentially execute arbitrary code through specially crafted UDP packets, as it compromises the integrity of memory allocated for the response. Affected versions before 25.12 lack adequate defenses like stack canaries and ASLR, heightening the risk of exploitation. OpenWrt has addressed this issue in version 25.12, promoting robust security practices and the necessity for timely updates.

Affected Version(s)

odhcpd < 25.12

News Articles

favicon imageThe Hacker News

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

OpenWrt 24.10.8 fixes CVE-2026-53921, a critical odhcpd stack overflow triggered by crafted DHCPv6 requests that could enable code execution.

References

https://github.com/openwrt/odhcpd/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/openwrt/odhcpd/commit/0320032ae313452f...
x_refsource_MISC
https://github.com/openwrt/odhcpd/commit/03dacc23356b5789...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 📰

    First article discovered by The Hacker News

  • Vulnerability Reserved

.