OpenWrt odhcpd: Stack-based buffer overflow (CVE-2026-53921)
An unauthenticated remote code execution vulnerability (CVE-2026-53921) in the OpenWrt DHCPv6 server component odhcpd allows attackers to execute code with root privileges via crafted DHCPv6 requests.
CVE search metadata
CVE search record: CVE-2026-53921. KEV: no. Product: odhcpd (< 24.10.8). Brief: OpenWrt odhcpd: Stack-based buffer overflow (CVE-2026-53921). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openwrt-odhcpd-rce/
Triage facts
Revision 1- Applicability
- odhcpd (< 24.10.8)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 22, 07:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
CVE-2026-53921 is a stack-based buffer overflow vulnerability in the OpenWrt DHCPv6 server component, odhcpd. The vulnerability allows an unauthenticated remote attacker to send a specially crafted DHCPv6 REQUEST packet to the server, resulting in memory corruption. This can lead to arbitrary code execution with root privileges or a Denial of Service (DoS) condition. The vulnerability has been confirmed with a CVSS score of 9.8.
Impact
Successful exploitation allows for unauthenticated remote code execution with root-level privileges on affected OpenWrt devices. This grants attackers full control over the compromised network device, potentially facilitating lateral movement within the network, traffic interception, or permanent device compromise.
Recommendation
- Upgrade OpenWrt devices to version 24.10.8 or 25.12.5 and later to incorporate the security patch.
- Implement network segmentation to restrict DHCPv6 traffic exposure to only authorized and trusted network segments.
- Prioritize patching for internet-facing gateways or devices providing DHCPv6 services to untrusted network zones.
Immediate actions
Inventory all OpenWrt devices and verify current odhcpd/firmware versions.
Mitigations
Upgrade OpenWrt devices to 24.10.8 or 25.12.5.
CVE-2026-53921