CVE-2026-53920: CWE-125: Out-of-bounds Read in openwrt odhcpd

The odhcpd component in OpenWrt, responsible for DHCPv6, DHCPv4, and router advertisement services, contains an out-of-bounds read vulnerability (CWE-125) in its DHCPv6 IA parser. Specifically, the parser accepts IA_NA or IA_PD options whose bodies are shorter than the expected dhcpv6_ia_hdr structure but proceeds to cast and read fields like iaid without verifying the option's length. This leads to reading adjacent stack memory beyond the 8192-byte receive buffer. ARM validation showed leakage of the saved stack canary and potentially other ASLR-useful stack contents. The vulnerability affects versions >=17.01.0 and <25.12.3 and was fixed in version 25.12.3.

An unauthenticated attacker on the same network segment can send specially crafted DHCPv6 IA options that cause odhcpd to read and disclose adjacent stack memory contents. This memory disclosure includes sensitive data such as stack canaries and ASLR-related information, which could aid in further exploitation or bypassing security mitigations. There is no indication of remote code execution or denial of service from this vulnerability alone.

This vulnerability has been addressed by an official fix in OpenWrt odhcpd version 25.12.3. Users should upgrade to version 25.12.3 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.