A use‑after‑free bug in the odhcpd DHCPv6 IA handler allows a specially crafted DHCPv6 REQUEST packet from an adjacent‑network client to free a lease and leave an internal pointer dangling. A later IA option in the same packet allocates a new lease using the dangling pointer, resulting in a read of a 16‑byte Reconfigure key that may be zeroed. The vibration of this vulnerability has been validated as an unauthenticated denial of service and causes confusion of the Reconfigure/ForceRenew key used by IPv6 clients. No evidence indicates arbitrary code execution can be achieved with the UAF alone. Weakening of the key may lead to protocol mis‑behaviour.

The vulnerability affects the openwrt:odhcpd DHCPv6 server on all builds prior to version 25.12. Users running older OpenWrt releases with odhcpd before the 25.12 update are potentially impacted.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is unavailable, so the current estimated exploitation probability is unknown, but the fact that the issue can be triggered by a crafted packet sent from an adjacent network suggests it is network‑based and requires an attacker to be within or able to inject traffic into the local network segment. The vulnerability is not listed in the CISA KEV catalog, and no active exploit has been reported. The likely attack vector is an unauthenticated adjacent‑network client sending a DNS‑style packet; success requires no special privileges and does not rely on user interaction. The risk for enterprises with exposed DHCPv6 services is therefore high, especially for networks that allow neighboring subnet clients.