IT SBIT Services
Schneeberger
DEEN
CVE tracker

OpenWrt odhcpd: Use-after-free in DHCPv6 IA handling

CVE-2026-53918High 8.8

← All vulnerabilities

Summary

odhcpd, the DHCPv6, DHCPv4 and router advertisement server used by OpenWrt, contains a use-after-free flaw in its DHCPv6 IA handler. A DHCPv6 REQUEST with multiple IA options can cause a freed lease pointer to be read, producing a 16-byte heap read that can lead to a zeroed DHCPv6 Reconfigure key. The attack requires no authentication but only an attacker on the same adjacent network segment. The validated impact is denial of service and DHCPv6 Reconfigure/ForceRenew key confusion; arbitrary code execution is not proven for this flaw alone.

Affected

  • OpenWrt odhcpd versions prior to 25.12 (CNA data)
  • Conflicting data: one source lists up to 25.11 only
  • According to the GitHub advisory, the affected code is also present in the 24.10 branch and in 25.12 and master snapshots
  • Unknown: whether a 24.10.x fix exists

Fixed in

  • Fix commits: 26b1220 (master) and 5b28383 (25.12)
  • OpenWrt 25.12.5 contains the fix according to its release notes
  • Unknown: a confirmed fixed 24.10.x release for this CVE

Workaround

  • Unknown: no official workaround published
  • Disable the DHCPv6 server on interfaces that do not need it
  • Restrict DHCPv6 traffic to trusted network segments

Exploitation

  • No known exploitation in the wild
  • CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial
  • A maintainer test bundle is referenced in the advisory; no public proof of concept was confirmed

Our recommendation

  • Inventory all OpenWrt devices and identify their version and branch
  • Upgrade to OpenWrt 25.12.5 or later; for 24.10 devices, confirm the fix status before assuming it is covered
  • Verify the odhcpd package version after the update, not only the firmware version
  • Patch the whole odhcpd package, as other critical pre-authentication DHCPv6 flaws are fixed in the same release
  • Restrict DHCPv6 exposure to trusted LAN segments and monitor for unusual DHCPv6 traffic

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:41.

Original description (NVD)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed