An integer underflow (CWE‑191) in the Emergency Access Daemon’s handle_send_a function allows any unauthenticated local attacker to crash the daemon by sending a single crafted UDP packet. The packet’s length value underflows before a bounds check, causing a very large size to be passed to memcpy, which triggers a crash and results in a denial of service. No code execution or data exfiltration is possible; the impact is the interruption of the daemon’s availability.

Vulnerable OpenWrt installations running any version prior to 25.12.5. The issue resides in the OpenWrt openwrt product, specifically within the Emergency Access Daemon component. The fix is delivered in v25.12.5 and newer. Devices running older releases are at risk if they receive untrusted local network traffic.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% suggests exploitation is very unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local network; an attacker only needs the ability to send UDP packets to the device. The risk is moderate, with exploitation requiring no special credentials and only local network access.