---
id: "CVE-2026-53918"
kind: "vulnerability"
aliases: ["CVE-2026-53918"]
title: "odhcpd: crafted DHCPv6 request causes heap use-after-free on OpenWrt routers"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dhcpv6", "infrastructure", "odhcpd", "openwrt", "routers", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T14:17:53+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-23T22:31:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53918", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# odhcpd: crafted DHCPv6 request causes heap use-after-free on OpenWrt routers

odhcpd, the DHCPv6 and router-advertisement server on OpenWrt, has a heap use-after-free triggered by one crafted DHCPv6 REQUEST with multiple IA options. An unauthenticated client on the adjacent network can crash the service and may leak or corrupt the DHCPv6 Reconfigure authentication key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run opkg list-installed odhcpd or apk info odhcpd to get the installed version.

## Fix

Upgrade odhcpd to version 25.12 or later.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53918

## From the sources

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_