CVE-2026-55606: odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenWrt systems running odhcpd version 25.12 or earlier are affected when odhcpd processes DHCPv6 traffic on a little-endian host. The issue is in DHCPv6 self-loop detection.
Does exploitation require authentication or user interaction?
No. A single unauthenticated DHCPv6 packet can trigger the overread; no credentials or user interaction are required.
Is a public patch available?
No publicly available patches were available at the time of publication.