EUVD-2026-97968Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin same local link as target
-
DeliveryObtain two DHCPv6 bindings via SOLICIT/REQUEST
-
ExploitSend crafted RENEW with multiple IA_NA options
-
ExecutionTrigger size_t underflow and stack buffer overflow
-
ImpactCrash odhcpd and sustain DHCPv6 service outage
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be on the same local link (AV:A, network-adjacent) as a device running odhcpd with DHCPv6 service active - the default configuration on OpenWrt. The attacker must first complete legitimate DHCPv6 SOLICIT and REQUEST exchanges to obtain two valid bindings, then send a single crafted RENEW containing multiple IA_NA options (one matched IA that consumes most of the response buffer, one unmatched IA that triggers an oversized NOBINDING response, and a following matched IA) to drive the unsigned size_t underflow. No authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors: the attack is confined to the local link and cannot be launched across routed/internet boundaries, and impact is limited to repeated service crashes (A:H) with no confidentiality or integrity loss and no code execution. |
| Impact | This is a genuine but moderate-severity availability issue, correctly rated 6.5 by the input CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vector confirms a network-adjacent (same-link), low-complexity, unauthenticated attack with no user interaction and a pure availability impact (C:N/I:N/A:H) - consistent with the description, which explicitly states 'the observed configuration does not establish code execution.' No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit (POC) was supplied in the data, so there is no evidence of active exploitation; this should be treated as no public exploit identified at time of analysis. The main caveat is a clear conflict between the input Tags ('RCE') and the authoritative description plus the vendor advisory, which classify this as a Moderate pre-auth denial of service, not remote code execution - the stack canary terminates the process rather than allowing control-flow hijack. Net: a real, default-enabled, pre-auth DoS worth patching on exposed LANs, but not a code-execution emergency; the sibling CVE-2026-53921 (Critical stack overflow) in the same release is the higher-priority item. |
| Exploit ScenarioDerived | An attacker connected to the same local link (e.g., a guest Wi-Fi or compromised LAN device) completes normal DHCPv6 SOLICIT/REQUEST exchanges to obtain two bindings, then sends a crafted RENEW containing multiple IA_NA options that triggers an unsigned size_t underflow and overflows the 512-byte stack buffer. The stack canary aborts odhcpd; sustained packets repeatedly crash the process faster than procd can respawn it, denying DHCPv6/RA service to the network. No public exploit code was provided in the source data, and the flaw yields denial of service only, not code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unauthenticated flooding of crafted DHCPv6 RENEW messages can repeatedly crash odhcpd, the DHCPv6/DHCPv4/router-advertisement server shipped and enabled by default on OpenWrt, denying IPv6 address configuration to clients on the local link. An attacker who is network-adjacent (AV:A, PR:N, UI:N) must first complete two legitimate SOLICIT/REQUEST exchanges to obtain bindings, then send a single RENEW containing multiple IA_NA options that triggers an unsigned size_t underflow and lets attacker-controlled data be serialized past the 512-byte stack buffer pdbuf; the stack canary terminates the daemon and procd respawns it, so sustained packets cause recurring DHCPv6 outages. Impact is availability-only (C:N/I:N/A:H) and the observed configuration does not establish code execution; no public exploit identified at time of analysis, and the issue is fixed in OpenWrt 25.12.5.
RemediationAI
Vendor-released patch: OpenWrt 25.12.5 (odhcpd commits c6792bac, d08dbcc5, d168c27f and d329a154), so the primary action is to upgrade OpenWrt to 25.12.5 or later - the same release also fixes CVE-2026-53921, CVE-2026-53918, CVE-2026-53920 and CVE-2026-55606, and the release notes explicitly recommend updating because these services are enabled by default; rebuild/backport rather than hand-editing, since the fix is a two-line clamp in dhcpv6_ia_handle_IAs(). If the device cannot be updated promptly, the most effective compensating control is to stop serving DHCPv6 to untrusted peers: on the affected interface set the odhcpd DHCPv6 mode to disabled (UCI option 'dhcpv6' set to 'disabled' instead of 'server'/'hybrid'), accepting that IPv6 clients will fall back to stateless autoconfiguration and lose DHCPv6-assigned addresses, DNS and delegated prefixes. Segregating or client-isolating the L2 segment (guest VLAN, per-port isolation, or 802.1X) removes the adjacent position the exploit requires, since the attack cannot cross a routed boundary; this is a topology change rather than a device fix and does not help against a compromised host already on the trusted LAN. Because a successful packet only kills the process and procd respawns it, log-based detection of repeated odhcpd restarts is useful for triage but not a mitigation - do not rely on rate limiting alone. Verified guidance and affected-version details are in the vendor advisory at https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in dhcpv6_ia_handle_IAs() in odhcpd's src/dhcpv6-ia.c and is classified CWE-121 (stack-based buffer overflow), though the underlying defect is an unsigned-size arithmetic error. In the RENEW path the function subtracts the return value of a prior IA build from a remaining-space counter held in a size_t; when an unmatched IA_NA drives the build_ia() status branch to emit a NOBINDING response larger than the space remaining after a preceding matched IA, that subtraction underflows. Because the result is unsigned, it becomes an enormous value, which disables the subsequent length checks and allows the attacker-controlled IA_ADDR contents to be serialized beyond the fixed 512-byte stack buffer pdbuf used in handle_client_request(). The stack canary then aborts the process. The upstream fix (commits c6792bac, d08dbcc5, d168c27f, d329a154) simply clamps handshake_len and ia_response_len to buflen before use, restoring the invariant that a response length can never exceed the buffer size. DHCPv6 IA_NA/IA_PD option parsing is reachable pre-authentication from any host on the same L2 segment, which is why an adjacent attacker needs no credentials; the requirement to hold two valid bindings is what constrains the attack to a link-local peer that can legitimately speak DHCPv6 to the server.
Know when Odhcpd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Same-link reach gives AV:A; no auth is needed to obtain bindings and send RENEW so PR:N/UI:N; impact is crash-only, hence C:N/I:N/A:H with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB