CVE-2026-86509: D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
Published Sep 8, 2026
·Updated
A flaw has been found in D-Link DIR-895L A1102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.
Affected Software
1 affected component
D-Link DIR-895L=A1_102b07
Event History
Sep 8, 2026
CVE Published
via MITRE·12:45 AM
Data Sourced
via MITRE·12:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Nov 21, 58655
Event
via NVD·06:44 AM
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be able to reach the affected device from the local network. No privileges or user interaction are required according to the supplied vector.
2
Which deployment is known to be affected?
The reported affected product is the D-Link DIR-895L running A1_102b07. The vulnerable component is udhcpcd, specifically its sendOffer/sendACK handling in serverpacket.c.
3
Is exploit code available?
Yes. The report states that an exploit has been published and may be used.