CVE-2026-53918: CWE-416: Use After Free in openwrt odhcpd
Description
CVE-2026-53918 is a use-after-free vulnerability in the odhcpd DHCPv6 handler used by OpenWrt. It affects versions prior to 25.12 and involves a dangling pointer when processing multiple IA options in a DHCPv6 message, leading to a heap-use-after-free read. This can cause unauthenticated denial of service and confusion of DHCPv6 Reconfigure/ForceRenew keys. The issue has been patched in version 25.12.
CVSS v4.0
Score 8.8high
Affected software
openwrt
odhcpd
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in odhcpd's DHCPv6 IA handler where a per-message 'first' lease pointer is reused across multiple IA options. A DHCPv6 REQUEST from an adjacent-network client can cause the 'first' pointer to become dangling after a lease is freed due to a failed on-link check. Subsequent IA options in the same packet then use this dangling pointer, causing a 16-byte heap-use-after-free read. AddressSanitizer confirms the use-after-free, and native tracing shows deterministic reclaiming of the freed lease, resulting in a zeroed Reconfigure key copy. The impact includes unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. There is no proof that this vulnerability alone allows arbitrary program counter control. The vulnerability is fixed in OpenWrt odhcpd version 25.12.
Potential Impact
An unauthenticated attacker on an adjacent network can exploit this vulnerability to cause denial of service by triggering a use-after-free condition in the DHCPv6 server component. Additionally, the vulnerability can cause confusion in DHCPv6 Reconfigure and ForceRenew keys, potentially disrupting DHCPv6 operations. There is no evidence that this vulnerability alone enables arbitrary code execution.
Mitigation Recommendations
This vulnerability has been officially fixed in OpenWrt odhcpd version 25.12. Users should upgrade to version 25.12 or later to remediate this issue. No other mitigation actions are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T15:46:12.315Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb61954d27ba8daa2c43b1
Added to database: 10/23/2026, 13:31:01 UTC
Last enriched: 10/23/2026, 13:45:31 UTC
Last updated: 10/23/2026, 15:26:05 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.