OpenWrt odhcpd up to 25.11 DHCPv6 IA handler use after free

Summaryinfo

A vulnerability categorized as critical has been discovered in OpenWrt odhcpd up to 25.11. The impacted element is an unknown function of the component DHCPv6 IA handler. The manipulation results in use after free. This vulnerability is identified as CVE-2026-53918. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in OpenWrt odhcpd up to 25.11. Affected is an unknown functionality of the component DHCPv6 IA handler. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on integrity, and availability. CVE summarizes:

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-53918 since 06/11/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 25.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• OpenWrt

Name

• odhcpd

Version

• 25.0
• 25.1
• 25.2
• 25.3
• 25.4
• 25.5
• 25.6
• 25.7
• 25.8
• 25.9
• 25.10
• 25.11

Website

• Product: https://github.com/openwrt/odhcpd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion