CVE-2026-53921— odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
Quick assessment
Affected
openwrt odhcpd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
odhcpd 是 OpenWrt 中用于处理 DHCPv6、DHCPv4 及路由器通告（Router Advertisement）的服务器软件。在 25.12 版本之前，当单个 DHCPv6 REQUEST 报文包含足够多的 IA（身份关联）选项，导致响应空间几乎耗尽时，odhcpd 的 DHCPv6 IA 响应处理程序会将数据写入到一个固定大小为 512 字节的栈缓冲区（pdbuf）之外，造成栈缓冲区溢出。在同一调用链中存在两个独立的溢出点，且均可通过单个未认证的 UDP 数据包从网络触发。由于 odhcpd 在
In-the-Wild Activity Observed
github_trending · medium
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53921
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
Source: CVE Program / CVE List V5
Vulnerability Description
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-53921
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53921
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53921 (6)
Vendor Advisories for CVE-2026-53921 (1)
Same Patch Batch · openwrt · 2026-10-23 · 4 CVEs total
| CVE-2026-53918 | 8.8 HIGH | odhcpd DHCPv6 IA dangling first pointer use-after-free |
| CVE-2026-53920 | 8.7 HIGH | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure |
| CVE-2026-55606 | 6.5 MEDIUM | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() |
IV. Related Vulnerabilities
Same product: odhcpd
Same vendor: openwrt
-
CVE-2026-55606
odhcpd: Stack buffer overread via DUID length endianness mis -
CVE-2026-53918
odhcpd DHCPv6 IA dangling first pointer use-after-free -
CVE-2026-53920
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure -
CVE-2026-53922
odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_i -
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through fi
Same weakness: CWE-121
-
CVE-2026-115863
ConnMan 2.0 前版本 DHCPv6 栈缓冲区溢出漏洞 -
CVE-2026-96185
Microsoft Exchange Online Remote Code Execution Vulnerabilit -
CVE-2026-85079
Out-of-bounds write in Zigbee Simple_Desc_req handling -
CVE-2026-94502
Out-of-bounds write in Zigbee Publish Price Matrix handling -
CVE-2026-85080
Authenticated Denial-of-Service in Zigbee GetGroupMembership
V. Comments for CVE-2026-53921
No comments yet