What is CVE-2026-53921?
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Affected product
See advisory
Remediation Steps
- Update OpenWrt to version 24.10.8 or later
- Disable DHCPv6 server if not required for network operations
- Restrict network access to DHCPv6 server to trusted subnets only
- Monitor network traffic for crafted DHCPv6 packets targeting odhcpd service
- Verify patch installation and reboot affected devices
References
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 4 of July 2026 (July 27 – August 2)
Related vulnerabilities
- CVE-2021-27137 – Dd-Wrt (same weakness: CWE-121)
- CVE-2026-7273 – Zyxel GS1900 Series Switches (same weakness: CWE-121)
- CVE-2026-41089 – Microsoft Windows Server 2012 (same weakness: CWE-121)
- CVE-2025-53521 – F5 BIG-IP (same weakness: CWE-121)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.