The odhcpd DHCPv6 parser in OpenWrt accepts an IA_NA or IA_PD option whose body is shorter than the expected header length. The parser casts the incomplete option to a full structure and then reads the IAID field before validating that the body indeed contains it. This over‑read pulls bytes from adjacent stack memory, which are reflected back in the DHCPv6 reply. In many builds the bytes exposed include the stack canary and, with broader scans, ASLR‑useful stack or process information, enabling attackers to gather sensitive memory contents.

This flaw affects the odhcpd component of OpenWrt firmware from version 17.01.0 up to, but not including, 25.12.3. The package runs on a wide range of consumer routers, access points, and embedded networking devices that use OpenWrt as their operating system.

The CVSS base score is 8.7, classifying the vulnerability as high severity. The EPSS score is not available, so the likelihood of exploitation is currently unknown, and the issue is not listed in CISA’s KEV catalog. The vulnerability is exploitable by an unauthenticated, network‑adjacent client capable of sending crafted DHCPv6 IA_NA or IA_PD packets. Devices that expose DHCPv6 services to untrusted networks, or that lack proper segmentation, are at elevated risk of information disclosure when the flaw remains unpatched.