CVE-2026-86296 is a critical vulnerability in the D-Link DIR-822A A_101 router affecting the strcpy function in udhcpcd/serverpacket.c. The flaw is a stack-based buffer overflow that can be triggered remotely, allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a CVSS 3.1 base score of 10.0, indicating maximum severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Public exploit code has been disclosed, but no patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected device, potentially leading to full system compromise. Confidentiality, integrity, and availability of the device and network traffic may be severely impacted. Given the critical CVSS score and public exploit availability, this vulnerability poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider isolating affected devices from untrusted networks and monitoring for exploit attempts. Avoid exposing the device directly to the internet if possible.