CVE-2026-53921

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt

Risk score: 76/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.9%
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: odhcpd has a stack buffer overflow vulnerability in its DHCPv6 IA response handler, allowing an attacker to potentially execute code remotely. An attacker could exploit this vulnerability to execute code, access, or impact the confidentiality, integrity, or availability of the system.
Affected: {'products': ['odhcpd'], 'packages': ['odhcpd'], 'versions': ['prior to 25.12']}
Fix: Upgrade to version 25.12 or later
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

Original description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.

Last activity 23 Oct 2026. Patch Forecast updates every hour.