{"id":"CVE-2026-53920","kind":"vulnerability","aliases":["CVE-2026-53920"],"related":[],"title":"OpenWrt odhcpd: DHCPv6 IA parser leaks stack memory to network clients","description":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.","summary":"odhcpd, the DHCPv6 and router-advertisement server on OpenWrt, reads past a receive buffer when handling a short IA option from a client. The leaked bytes are returned in the DHCPv6 reply, exposing stack contents including the stack canary, which helps an attacker bypass memory protections.","severity":"high","cvss":8.7,"epss":0.00507,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcpv6","infrastructure","openwrt","routers"],"not_affected_if":["dhcpv6-server-disabled","patched-25.12.3-or-later"],"how_to_check":"Check the installed odhcpd version; the affected range is 17.01.0 up to but not including 25.12.3.","fix":"Upgrade odhcpd to 25.12.3 or later.","status":"open","published_at":"2026-10-23T14:17:53+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:35:03+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:35:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade odhcpd to 25.12.3 or later.","reach":"network","title":"OpenWrt odhcpd: DHCPv6 IA parser leaks stack memory to network clients","impact":"medium","summary":"odhcpd, the DHCPv6 and router-advertisement server on OpenWrt, reads past a receive buffer when handling a short IA option from a client. The leaked bytes are returned in the DHCPv6 reply, exposing stack contents including the stack canary, which helps an attacker bypass memory protections.","category":"infrastructure","who_cares":["openwrt","routers","dhcpv6"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads stack memory, including the canary, aiding exploitation","analyst_note":"","how_to_check":"Check the installed odhcpd version; the affected range is 17.01.0 up to but not including 25.12.3.\nunknown","needs_analyst":false,"not_affected_if":["patched-25.12.3-or-later","dhcpv6-server-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0011,"input_tokens":3137,"output_tokens":1572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-53920':14A,17A '17.01.0':84C '25.12.3':88C,214C '8192':156C,189C '8196':190C 'accept':94C 'adjac':138C,169C 'advertis':28B,77C 'arm':184C 'aslr':203C 'aslr-us':202C 'attack':65B 'bodi':103C,128C 'buf':167C,188C 'buffer':36B,160C 'bypass':66B 'byte':48B,157C,174C 'canari':61B,195C 'cast':111C 'client':11A,45B,139C 'contain':129C 'content':57B,206C 'cross':164C 'cve':12A,15A 'data':166C,187C 'dhcpv4':73C 'dhcpv6':3A,18B,24B,53B,72C,91C,108C,180C 'disclos':173C,191C 'end':152C 'expos':55B 'field':132C 'full':117C 'handl':38B 'hdr':110C 'header':114C 'help':63B 'ia':4A,41B,92C,96C,99C,109C,121C,127C,148C 'iaid':122C,131C,162C,182C 'includ':58B 'infrastructur':19B 'issu':208C 'leak':6A,47B,201C 'length':144C 'memori':8A,67B,171C 'na':97C 'network':10A,137C 'network-adjac':136C 'odhcpd':2A,22B,69C,89C,154C 'openwrt':1A,20B,31B,81C 'option':42B,101C,113C,149C 'otherwis':146C 'parser':5A,93C 'past':33B 'patch':211C 'pd':100C 'place':140C 'prior':183C 'protect':68B 'prove':124C 'read':32B,120C,163C 'receiv':35B,158C 'reflect':177C 'repli':54B,181C 'return':50B 'router':21B,27B,76C 'router-advertis':26B,75C 'save':193C 'scan':199C 'server':29B,78C 'short':40B,147C 'shorter':105C 'show':186C 'stack':7A,56B,60B,159C,170C,194C,198C 'stack/process':205C 'struct':107C 'structur':118C 'unauthent':135C 'use':79C,204C 'valid':185C 'version':83C,87C,213C 'whose':102C 'wider':197C 'zero':143C 'zero-length':142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-53920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53920","severity":null,"published_at":"2026-10-23T14:17:53+00:00","modified_at":"2026-10-23T21:17:23+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-53920","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53920","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}