Live › vulnerability › CVE-2026-53920
Go to dashboardodhcpd, the DHCPv6 and router-advertisement server on OpenWrt, reads past a receive buffer when handling a short IA option from a client. The leaked bytes are returned in the DHCPv6 reply, exposing stack contents including the stack canary, which helps an attacker bypass memory protections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed odhcpd version; the affected range is 17.01.0 up to but not including 25.12.3.
Upgrade odhcpd to 25.12.3 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-53920")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.