CVE-2026-53922

Received Received - Intake

DHCPv6 Stack Buffer Overflow in OpenWrt odhcpd

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-53922

Affected Vendors & Products

Vendor	Product	Version / Range
openwrt	odhcpd	< c6792bac3905d4bf726d914e9994f6d4b98c5b57
openwrt	openwrt	< 25.12.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability in odhcpd, the DHCPv6 server used by OpenWrt, allows an unauthenticated attacker on the same network to send a crafted DHCPv6 RENEW message with multiple IA_NA options. This causes a buffer overflow in the stack, leading to a crash of the odhcpd service. The issue stems from incorrect handling of response buffer sizes and an unsigned integer underflow.

Detection Guidance

This vulnerability can be detected by monitoring for repeated crashes of the odhcpd process on OpenWrt systems. Check logs for odhcpd segmentation faults or respawns triggered by malformed DHCPv6 packets. Use tcpdump to capture DHCPv6 traffic and look for packets with multiple IA_NA options or unusual RENEW messages.

Impact Analysis

If exploited, this vulnerability can disrupt DHCPv6 service on your OpenWrt router, causing network connectivity issues for IPv6 devices. The service may repeatedly crash and restart, leading to intermittent connectivity problems. However, it does not allow code execution or direct data theft.

Compliance Impact

This vulnerability causes denial-of-service (DoS) conditions by crashing the DHCPv6 service, which could disrupt network operations. For GDPR, this may impact availability of network services processing personal data. For HIPAA, it could affect systems handling protected health information by interrupting network connectivity. However, no direct evidence of data exposure or compliance violations is provided in the CVE details.

Mitigation Strategies

Update odhcpd to a version that includes the fix from commit cfddd56 or later. Disable DHCPv6 service if not required. Monitor network traffic for unusual DHCPv6 packets with multiple IA_NA options.

Hi! I’m here to help you understand CVE-2026-53922. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70