Live › vulnerability › CVE-2026-53918
Go to dashboardodhcpd, the DHCPv6 and router-advertisement server on OpenWrt, has a heap use-after-free triggered by one crafted DHCPv6 REQUEST with multiple IA options. An unauthenticated client on the adjacent network can crash the service and may leak or corrupt the DHCPv6 Reconfigure authentication key.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run opkg list-installed odhcpd or apk info odhcpd to get the installed version.
Upgrade odhcpd to version 25.12 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message first lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set first, then make a later same-IAID IA fail the on-link check and free that same lease, leaving first dangling. A following IA in the same packet allocates a new lease and copies first->key, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
This page as .md · .json · in your agent: get_signal("CVE-2026-53918")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.