CVE-2026-55490: OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service
OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handlesenda() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenWrt Emergency Access Daemon (EAD)to a version that resolves this vulnerability.Fixed in v25.12.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55490?
The severity of CVE-2026-55490 is medium with a score of 6.5.
How do I fix CVE-2026-55490?
To fix CVE-2026-55490, upgrade OpenWrt to version v25.12.5 or later.
What type of vulnerability is CVE-2026-55490?
CVE-2026-55490 is an integer underflow vulnerability affecting the Emergency Access Daemon.
Who can exploit CVE-2026-55490?
CVE-2026-55490 can be exploited by any unauthenticated attacker on the local network.
What impact does CVE-2026-55490 have?
CVE-2026-55490 allows an attacker to cause a denial of service by crashing the Emergency Access Daemon.