CVE-2026-55606: CWE-126: Buffer Over-read in openwrt odhcpd

The odhcpd component of OpenWrt, which handles DHCPv6, DHCPv4, and router advertisements, contains a buffer over-read vulnerability (CWE-126) in its DHCPv6 self-loop detection logic. Specifically, at dhcpv6.c line 720, the code uses a DUID length value in network byte order directly as the size argument to memcmp(). On little-endian hosts, this causes memcmp() to read far beyond the intended 128-byte buffer, leading to a 2560-byte overread. This flaw can be exploited by sending a single unauthenticated DHCPv6 packet. As of the publication date, no official patch or fix has been released.

An attacker can trigger a buffer over-read by sending a crafted DHCPv6 packet to an affected odhcpd server, causing the server to read memory beyond the allocated buffer. This may lead to information disclosure (partial memory contents) and potentially cause a denial of service due to application instability. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, limited confidentiality impact, no integrity impact, and low availability impact.

At the time of this report, no official patches or fixes are publicly available for this vulnerability. Users should monitor the OpenWrt project advisories for updates and apply patches once released. Until then, consider network-level controls to restrict unauthenticated DHCPv6 traffic from untrusted sources to reduce exposure.