odhcpd, the OpenWrt DHCPv6 and router-advertisement daemon, contains a stack buffer overflow in the response serialization code for DHCPv6 IA options. A single unauthenticated UDP REQUEST that carries enough IA options to exhaust the 512‑byte reply buffer can overwrite adjacent stack memory. The overflow allows an attacker to corrupt the execution context and potentially inject code, leading to arbitrary code execution with the privileges of the odhcpd process, which runs as root on OpenWrt devices.

Devices running OpenWrt with odhcpd before the 25.12 release are vulnerable. The daemon is the default DHCPv6 and router-advertisement server in the distribution, so nearly all OpenWrt installations that have not applied the 25.12 update are affected.

The CVSS score of 9.8 indicates critical severity. Although EPSS data is not available and KeV does not list this vulnerability, the lack of stack canaries and ASLR on many embedded targets makes realistic exploitation likely. Two independent overflow conditions exist in the same call chain, both reachable over UDP, implying that a remote, unauthenticated attacker can trigger the vulnerability from any reachable network node. The vulnerability can be exploited without authentication, making it a high‑risk security flaw for all affected devices.