CVE-2026-53920: high-severity vulnerability in openwrt odhcpd
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
openwrt · odhcpdRelated CVEs — openwrt odhcpd
In the same product, most dangerous first.
CVE-2026-53921CRITICALodhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)EPSS 1.1%CVE-2026-53922MEDIUModhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)EPSS 0.6%CVE-2026-53918HIGHodhcpd DHCPv6 IA dangling first pointer use-after-freeEPSS 0.5%CVE-2026-55606MEDIUModhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()EPSS 0.4%