CVE-2026-53921: odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
odhcpdto a version that resolves this vulnerability.Fixed in 25.12
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenWrt systems running odhcpd before version 25.12 are affected where the DHCPv6 service is reachable by an attacker. The vulnerable handler processes DHCPv6 IA options in network-supplied requests.
What does an attacker need to exploit it?
An attacker can reach both overflow sites with a single unauthenticated DHCPv6 UDP REQUEST containing enough IA options to nearly exhaust the reply space. No credentials or user interaction are required.
What is the likely impact of successful exploitation?
odhcpd runs as root on OpenWrt, so successful exploitation can provide high-impact compromise of confidentiality, integrity, and availability. Code execution is described as realistic on embedded targets that lack stack canaries and ASLR.
How can I remediate the issue?
Update odhcpd to version 25.12, which includes the patch. If updating cannot happen immediately, reduce exposure by preventing untrusted networks from reaching the DHCPv6 service.