CVE-2026-53920 in odhcpd
Summary
by MITRE • 10/23/2026
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within odhcpd, a critical component of the OpenWrt operating system responsible for handling DHCPv4, DHCPv6, and router advertisement services, represents a severe stack-based buffer over-read condition that facilitates information disclosure through memory leakage. This flaw exists in versions ranging from 17.01.0 up to but not including version 25.12.3. The core technical deficiency lies within the Internet Address (IA) parser for DHCPv6, specifically when processing IA_NA or IA_PD options. Under normal operational parameters, these protocol options contain a header followed by specific data fields such as the Identity Association Identifier (IAID). However, due to insufficient validation of option lengths prior to type casting and field access, the software fails to verify that the body of an incoming IA option meets the minimum size requirements defined by the struct dhcpv6_ia_hdr structure.
When a network-adjacent client sends a DHCPv6 packet containing an IA_NA or IA_PD option with a body shorter than the expected header size, odhcpd proceeds without raising an error. Instead of rejecting the malformed packet, the application casts the truncated data to the full struct dhcpv6_ia_hdr structure and immediately attempts to read the ia->iaid field. Because the actual payload is too short, this memory access operation reads beyond the bounds of the allocated buffer into adjacent stack memory. The odhcpd service utilizes an 8192-byte receive stack buffer for processing incoming DHCP requests. When a malicious actor places a zero-length or significantly shortened IA option at the end of this buffer, the read operation crosses from the data_buf boundary directly into the surrounding stack space where other variables and control structures reside.
The operational impact of this vulnerability is significant due to its potential for remote information disclosure without authentication. The bytes leaked from adjacent stack memory are not discarded but are instead reflected back in the DHCPv6 reply sent to the client, specifically within the IAID field of the response packet. This mechanism effectively turns a standard protocol exchange into an arbitrary read primitive. Prior analysis on ARM architectures demonstrated that this flaw can disclose the saved stack canary value by reading data_buf[8192:8196]. The disclosure of the stack canary is particularly dangerous as it neutralizes one of the primary defenses against buffer overflow attacks, thereby facilitating further exploitation such as arbitrary code execution. Furthermore, wider scans beyond the immediate boundary can leak other sensitive process contents and ASLR (Address Space Layout Randomization) keys, which are critical for bypassing memory protection mechanisms in modern operating systems.
From a classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, as it involves accessing memory locations outside of the intended buffer boundary. It also maps to ATT&CK technique T1074 Data Staged or Localized if viewed through the lens of data collection for subsequent exploitation phases, though its primary immediate effect is information leakage akin to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability allows unauthenticated attackers on the same network segment to gather intelligence about the target system's memory layout and security mitigations, significantly lowering the barrier for advanced persistent threats or opportunistic attackers seeking to compromise router integrity.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators running OpenWrt systems should upgrade odhcpd to version 25.12.3 or later, where this parsing logic has been corrected to validate option lengths before accessing structure fields. In environments where patching is not immediately feasible, network segmentation and firewall rules can be employed to restrict DHCP traffic sources to trusted subnets only, thereby reducing the attack surface for unauthenticated clients. Additionally, enabling strict logging on router interfaces may help detect anomalous patterns of malformed DHCP requests that could indicate active exploitation attempts targeting this specific memory corruption flaw.