Description
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Published: 2026-10-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Buffer Overread
Action: Monitor
AI Analysis

Impact

This vulnerability in OpenWrt's odhcpd causes a stack buffer overread in the DHCPv6 self-loop detection logic. A single unauthenticated DHCPv6 packet can trigger memcmp() to read 2560 bytes from a 128‑byte buffer when the host is little‑endian, potentially leaking hidden stack data or causing a crash. The weakness is a classic buffer overread (CWE‑126).

Affected Systems

The affected product is OpenWrt's odhcpd component, with versions 25.12 and earlier vulnerable. The issue remains unpatched in the current OpenWrt releases.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote, unauthenticated DHCPv6 packet sent by an entity that can reach the router over the network, relying on little‑endian host interpretation of the DUID length field.

Generated by OpenCVE AI on October 23, 2026 at 16:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Block unsolicited DHCPv6 traffic with firewall or router ACLs
  • Monitor device logs for abnormal overread or crash events
  • Plan to upgrade to a patched OpenWrt version when it becomes available or disable DHCPv6 if not required

Generated by OpenCVE AI on October 23, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Openwrt
Openwrt odhcpd
Vendors & Products Openwrt
Openwrt odhcpd

Fri, 23 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Title odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
Weaknesses CWE-126
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Openwrt Odhcpd
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-29T17:43:41.478Z

Reserved: 2026-06-16T23:31:22.445Z

Link: CVE-2026-55606

cve-icon Vulnrichment

Updated: 2026-10-29T17:43:34.971Z

cve-icon NVD

Status : Deferred

Published: 2026-10-23T14:17:53.850

Modified: 2026-10-29T18:17:33.527

Link: CVE-2026-55606

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T23:30:17Z

Weaknesses