CVE-2026-53918

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt

Risk score: 66/100
CVSS: 8.8 v4.0
Exploit chance (30 days): 0.5%
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: odhcpd has a heap-use-after-free vulnerability in its DHCPv6 IA handler, allowing an attacker to cause a denial of service and potentially confuse DHCPv6 Reconfigure/ForceRenew keys. An attacker can exploit this vulnerability without authentication.
Affected: {'products': ['OpenWrt'], 'packages': ['odhcpd'], 'versions': ['prior to version 25.12']}
Fix: Upgrade to version 25.12 or later
Exploitation: No known exploitation

Why it is Amber

CVSS 8.8 high
Remotely exploitable without logging in

References

Original description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

Last activity 23 Oct 2026. Patch Forecast updates every hour.