CVE-2026-53921: CWE-121: Stack-based Buffer Overflow in openwrt odhcpd

CVE-2026-53921 is a stack-based buffer overflow in the odhcpd component of OpenWrt, specifically in the DHCPv6 IA response handler. When a DHCPv6 REQUEST packet contains enough IA options to nearly fill the reply buffer, two independent overflow conditions occur in the same call chain, allowing writes past the end of a fixed 512-byte stack buffer named pdbuf. Since odhcpd runs as root and embedded targets often lack mitigations like stack canaries and ASLR, exploitation could lead to remote code execution. The vulnerability is exploitable remotely via unauthenticated UDP packets. The flaw was patched in OpenWrt version 25.12.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with root privileges on affected OpenWrt devices. This is due to the stack-based buffer overflow in odhcpd's DHCPv6 IA response handler. The vulnerability affects devices that process DHCPv6 requests and lack common memory protection mechanisms, increasing the likelihood of full system compromise.

Upgrade odhcpd to OpenWrt version 25.12 or later, where this vulnerability has been patched. No other mitigations are specified or required as the fix addresses the root cause.