{"id":"CVE-2026-53921","kind":"vulnerability","aliases":["CVE-2026-53921"],"related":[],"title":"OpenWrt odhcpd: DHCPv6 packet overflows stack, enables root code execution","description":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.","summary":"odhcpd, the DHCP and router-advertisement server on OpenWrt, has a stack buffer overflow in its DHCPv6 handler triggered by one crafted REQUEST packet. A remote attacker with no login can run code as root on the router.","severity":"critical","cvss":9.8,"epss":0.0088,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcpv6","embedded-routers","odhcpd","openwrt","runtime"],"not_affected_if":["odhcpd-not-installed","patched-25.12-or-later"],"how_to_check":"Run 'odhcpd -v' or check the installed OpenWrt package version (for example 'opkg list-installed | grep odhcpd') and compare it against 25.12.","fix":"Upgrade odhcpd to version 25.12 or later, which contains the patch.","status":"open","published_at":"2026-10-23T14:17:53+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:31:00+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:31:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade odhcpd to version 25.12 or later, which contains the patch.","reach":"network","title":"OpenWrt odhcpd: DHCPv6 packet overflows stack, enables root code execution","impact":"high","summary":"odhcpd, the DHCP and router-advertisement server on OpenWrt, has a stack buffer overflow in its DHCPv6 handler triggered by one crafted REQUEST packet. A remote attacker with no login can run code as root on the router.","category":"runtime","who_cares":["openwrt","odhcpd","embedded-routers","dhcpv6"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code as root on the router from one UDP packet.","analyst_note":"Confirm whether DHCPv6 service is enabled by default in OpenWrt builds and whether the exploit requires LAN access, via the NVD entry and the OpenWrt security advisory.","how_to_check":"Run 'odhcpd -v' or check the installed OpenWrt package version (for example 'opkg list-installed | grep odhcpd') and compare it against 25.12.","needs_analyst":true,"not_affected_if":["odhcpd-not-installed","patched-25.12-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000541,"input_tokens":3064,"output_tokens":469,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-53921':13A,16A '25.12':79C,159C '512':93C 'advertis':30B,71C 'aslr':147C 'attack':51B 'buffer':37B,96C 'byte':94C 'call':121C 'canari':145C 'carri':103C 'chain':122C 'code':9A,57B,149C 'craft':46B 'cve':11A,14A 'dhcp':26B 'dhcpv4':67C 'dhcpv6':3A,17B,41B,66C,82C,101C 'embed':19B,140C 'embedded-rout':18B 'enabl':7A 'end':89C 'enough':104C 'execut':10A,150C 'exhaust':109C 'exist':117C 'fix':92C 'handler':42B,85C 'ia':83C,105C 'independ':114C 'issu':153C 'lack':143C 'login':54B 'make':148C 'near':108C 'network':127C 'odhcpd':2A,21B,24B,63C,80C,134C 'often':142C 'one':45B 'openwrt':1A,22B,33B,75C,139C 'option':106C 'overflow':5A,38B,115C 'packet':4A,48B,133C 'past':87C 'patch':156C 'pdbuf':97C 'prior':76C 'reachabl':124C 'realist':151C 'remot':50B 'repli':111C 'request':47B,102C 'respons':84C 'root':8A,59B,137C 'router':20B,29B,62B,70C 'router-advertis':28B,69C 'run':56B,135C 'runtim':23B 'server':31B,72C 'singl':100C,130C 'site':116C 'space':112C 'stack':6A,36B,95C,144C 'target':141C 'trigger':43B 'two':113C 'udp':132C 'unauthent':131C 'use':73C 'version':78C,158C 'via':128C 'write':86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-53921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53921","severity":null,"published_at":"2026-10-23T14:17:53+00:00","modified_at":"2026-10-23T19:37:11+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-53921","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53921","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}