CVE-2026-53918 in odhcpd
Summary
by MITRE • 10/23/2026
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability resides within odhcpd, the dynamic host configuration protocol server responsible for managing IPv4 and IPv6 address assignments as well as router advertisements in OpenWrt-based network environments. Specifically, the flaw is located in the DHCPv6 Information Association handler, which processes lease requests from clients on adjacent networks. The core technical defect involves improper memory management of a per-message pointer named first during the processing of multiple IA options within a single DHCPv6 message. Under normal operation, this pointer tracks specific lease data to facilitate authentication key handling for reconfiguration messages. However, due to a logic error in the sequence of operations when validating on-link status and managing lease lifecycles, the system fails to correctly maintain reference integrity for this pointer under certain packet structures.
The operational mechanism of the exploit begins when an attacker sends a crafted DHCPv6 REQUEST from an adjacent network segment. The initial Information Association option within this message successfully sets the first pointer to a valid lease structure. Subsequently, a later IA with the same Interface Identifier fails the on-link validation check. This failure triggers a cleanup routine that frees the memory associated with the previously allocated lease referenced by the first pointer. Crucially, the code does not nullify or reset the first pointer after freeing the underlying object, leaving it as a dangling reference to deallocated heap memory. When a subsequent IA option in the same packet is processed and allocates a new lease, the system copies data from the stale first pointer into this new allocation. This results in a use-after-free condition where sixteen bytes of previously freed memory are read and copied, leading to unpredictable state corruption within the DHCPv6 reconfiguration authentication key structure.
Security analysis tools such as AddressSanitizer have confirmed that this sequence constitutes a heap-use-after-free vulnerability. Native tracing further demonstrates that an attacker can deterministically control the outcome by ensuring the freed lease is immediately reallocated for the destination of the copy operation. This specific memory layout manipulation results in the overwriting of the Reconfigure key with zeroed data rather than arbitrary code execution, which limits the immediate impact to denial of service and authentication bypass scenarios. The validated impacts include an unauthenticated adjacent-network denial of service condition where legitimate clients may be disrupted due to state corruption, as well as DHCPv6 Reconfigure and ForceRenew key confusion attacks that could allow unauthorized control over lease renewals if the attacker can predict or manipulate the resulting zeroed keys.
This vulnerability maps directly to CWE-416, Use After Free, which describes errors where a program uses memory after it has been freed, leading to undefined behavior. In terms of offensive security frameworks, this aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically the subcategory of resource exhaustion or state corruption that disrupts service availability. Additionally, aspects of authentication bypass relate to CWE-287, Improper Authentication, as the key confusion undermines the integrity of the reconfiguration process. The issue has been addressed in version 25.12 of odhcpd by correcting the pointer management logic and ensuring proper nullification or reallocation handling during lease lifecycle transitions. Administrators running OpenWrt systems should prioritize upgrading to this patched version to mitigate risks associated with adjacent network attacks targeting DHCPv6 services.