CVE-2026-53920

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.

• CWE-125
• CWE-126
• CWE-200
• CWE-201

• https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2
• https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42
• https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possibl…9.8
• CVE-2026-53915In JetBrains GoLand before 2026.1.3 remote code execution wa…8.8
• CVE-2026-53916Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-53917Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-53918odhcpd is the DHCPv6, DHCPv4, and router-advertisement serve…8.8
• CVE-2026-5392Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 me…5.4
• CVE-2026-53921odhcpd is the DHCPv6, DHCPv4, and router-advertisement serve…9.8
• CVE-2026-53922odhcpd is the DHCPv6, DHCPv4, and router-advertisement serve…6.5
• CVE-2026-53923vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-53924Gardens v2 is a modular governance framework that enables co…8.7
• CVE-2026-53925Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-53926NocoDB is software for building databases as spreadsheets. P…6.3