OpenWrt, a Linux‑based OS for embedded devices, contains a stack‑based buffer overflow in the mdns daemon. The vulnerability lies in the match_ipv6_addresses function, which copies incoming IPv6 reverse DNS queries from a name buffer into a 256‑byte stack array using strcpy, then extracts the address into a 46‑byte buffer without validating the length. An attacker can send a PTR query exceeding 46 bytes on UDP port 5353 to overflow this buffer, potentially leading to remote code execution.

Vulnerable versions of the OpenWrt operating system include any build before v24.10.6 and before v25.12.1. The affected product is the OpenWrt software, all builds that ship the mdns daemon in earlier releases.

The CVSS score of 9.5 indicates a high severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires crafting a specialized DNS query sent over multicast DNS to the device, successful exploitation is limited to environments where the device is reachable via UDP port 5353. Still, the stack overflow could permit arbitrary code execution once triggered.