CVE-2026-53921: Stack Buffer Overflow in odhcpd

CVE-2026-53921 identifies a stack buffer overflow in odhcpd, the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt, in versions prior to 25.12. The flaw is triggered when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply buffer space, causing two independent overflow sites in the same call chain. Both sites are reachable over the network via a single unauthenticated UDP packet.

odhcpd runs as root on OpenWrt: system administrators must understand that the lack of stack canaries and ASLR on embedded targets makes remote code execution realistic. The CVSS score is 9.8 (critical). The flaw has been patched in version 25.12. A recent GitHub signal (October 29, 2026) indicates the existence of analysis tools for this vulnerability.

Administrators of networks and providers running OpenWrt must update odhcpd to version 25.12 or later without delay. Pending patching, isolating OpenWrt systems from uncontrolled network access is the only practical mitigation. Monitoring DHCPv6 logs for anomalous requests is recommended to detect potential attack attempts.