{"id":"CVE-2026-53918","kind":"vulnerability","aliases":["CVE-2026-53918"],"related":[],"title":"odhcpd: crafted DHCPv6 request causes heap use-after-free on OpenWrt routers","description":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.","summary":"odhcpd, the DHCPv6 and router-advertisement server on OpenWrt, has a heap use-after-free triggered by one crafted DHCPv6 REQUEST with multiple IA options. An unauthenticated client on the adjacent network can crash the service and may leak or corrupt the DHCPv6 Reconfigure authentication key.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcpv6","infrastructure","odhcpd","openwrt","routers","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Run opkg list-installed odhcpd or apk info odhcpd to get the installed version.","fix":"Upgrade odhcpd to version 25.12 or later.","status":"open","published_at":"2026-10-23T14:17:53+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:31:03+00:00","updated_at":"2026-10-23T22:31:03+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:31:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade odhcpd to version 25.12 or later.\nunknown","reach":"network","title":"odhcpd: crafted DHCPv6 request causes heap use-after-free on OpenWrt routers","impact":"medium","summary":"odhcpd, the DHCPv6 and router-advertisement server on OpenWrt, has a heap use-after-free triggered by one crafted DHCPv6 REQUEST with multiple IA options. An unauthenticated client on the adjacent network can crash the service and may leak or corrupt the DHCPv6 Reconfigure authentication key.","category":"infrastructure","who_cares":["openwrt","routers","self-hosted","dhcpv6"],"confidence":0.7,"needs_auth":"no","worst_case":"Service crash on the router; DHCPv6 Reconfigure key corrupted; code execution not proven.","analyst_note":"Confirm which OpenWrt releases ship odhcpd below 25.12 and whether DHCPv6 server is enabled by default, via the NVD entry and the OpenWrt advisory.","how_to_check":"Run opkg list-installed odhcpd or apk info odhcpd to get the installed version.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000557,"input_tokens":3195,"output_tokens":475,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-53918':16A,19A '16':174C '25.12':92C,241C 'adjac':60B,125C,214C 'adjacent-network':124C,213C 'advertis':34B,84C 'alloc':164C,201C 'alon':233C 'arbitrari':224C 'asan':182C 'authent':74B,117C 'byte':175C 'caus':5A 'check':148C 'client':57B,127C 'confirm':183C 'confus':223C 'control':226C 'copi':169C,207C 'corrupt':70B 'craft':2A,48B 'crash':63B 'cve':14A,17A 'dangl':156C 'denial':216C 'destin':200C 'determinist':193C 'dhcpv4':80C 'dhcpv6':3A,20B,30B,49B,72B,79C,95C,120C,220C 'fail':143C 'first':103C,131C,134C,155C,170C 'follow':158C 'free':10A,44B,150C,180C 'freed':196C 'handler':97C 'heap':6A,40B,177C 'heap-use-after-fre':176C 'host':27B 'ia':53B,96C,108C,132C,142C,159C 'iaid':141C 'impact':210C 'infrastructur':21B 'issu':235C 'keep':98C 'key':75B,118C,171C,206C,222C 'later':138C 'leak':68B 'leas':104C,153C,167C,197C 'leav':154C 'link':147C 'make':129C,136C 'may':67B 'messag':102C,112C 'multipl':52B,107C 'nativ':186C 'network':61B,126C,215C 'new':166C 'odhcpd':1A,22B,28B,76C,93C 'on-link':145C 'one':47B,111C 'openwrt':12A,23B,37B,88C 'option':54B,109C 'packet':163C,190C 'patch':238C 'pc':225C 'per':101C 'per-messag':100C 'pointer':105C 'prior':89C 'produc':172C,202C 'proven':229C 'read':181C 'reclaim':194C 'reconfigur':73B,116C,205C 'reconfigure/forcerenew':221C 'request':4A,50B,121C 'reus':113C 'router':13A,24B,33B,83C 'router-advertis':32B,82C 'same-iaid':139C 'self':26B 'self-host':25B 'server':35B,85C 'servic':65B,218C 'set':133C 'shape':191C 'show':188C 'trace':187C 'trigger':45B 'uaf':185C,232C 'unauthent':56B,212C 'use':8A,42B,86C,178C 'use-after-fre':7A,41B 'valid':209C 'version':91C,240C 'zero':204C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-53918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53918","severity":null,"published_at":"2026-10-23T14:17:53+00:00","modified_at":"2026-10-23T19:37:11+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}