A heap-based buffer overflow occurs in the ASN.1 encoding routine used when LuCI signs a 2040‑bit RSA certificate. When a 255‑byte signature is encoded, the BIT STRING allocation is miscalculated by one byte, so a single byte is written past the heap buffer. This memory corruption could allow an attacker to overwrite adjacent data, potentially leading to arbitrary code execution. The Overwrite is triggered via the exported Lua function create_selfsigned(); whether it can be reached from a remote sender depends on how the hosting application exposes the Lua interface.

The vulnerability exists in the luci-lib-px5g package shipped with OpenWrt release branches from 18.06 through 25.12 inclusive. The package has been removed from the master branch, so newer builds post‑25.12 do not contain the vulnerable code. The affected products are thus OpenWrt routers running those release series and using the LuCI Web UI or Lua scripts that call create_selfsigned().

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. The attack vector relies on access to the Lua environment; if the host application exposes create_selfsigned() to untrusted users or remote input, the risk rises. In the absence of such exposure, the practical exploitability is lower. Overall, the risk is moderate but potentially high for systems that expose the vulnerable Lua function.