CVE-2026-53921Critical· 9.8▾ AbyssalPoC available

odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score66/ 100 · Elevated

impact 53.9 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Oct 23, 2026

Updated

Oct 23, 2026

CVSS

9.8

Vendor

openwrt

Product

odhcpd

CWE

CWE-121

Depth score

66 · Elevated

EPSS

—

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-23

GitHub PoCs

2 public repositories

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 1 day

Oct 23, 2026Published
Disclosed via CVEORG
Oct 23, 2026Public exploit observed
2 GitHub repos (last check)

openwrt CWE-121 #cve.org #exploit-available

Affected

odhcpd < 25.12

Full technical detail▾

Overview

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.

Affected

odhcpd < 25.12

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available