CVE-2026-62381: Heap-based Buffer Overflow in openwrt luci

The vulnerability exists in the native ASN.1 encoding routine asn1_add_obj (x509write.c) of luci-lib-px5g, where the allocation for a BIT STRING during certificate signing underestimates the required buffer size by one byte. Specifically, for a 255-byte signature, the DER length encoding calculation leads to a 259-byte allocation, but 260 bytes are written due to an additional unused-bits byte and DER length octet. This heap overflow can be triggered through the exported Lua interface function create_selfsigned(). The vulnerability is present in OpenWrt versions from 18.06 through 25.12 but is absent in the master branch where luci-lib-px5g was removed instead of patched.

The heap-based buffer overflow can lead to memory corruption, potentially causing crashes or other undefined behavior. Exploitability depends on the embedding application using the vulnerable Lua interface. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no privileges required but low user interaction, and high impact on availability. There are no known exploits in the wild at this time.

No official patch is currently available as the vulnerable code was removed from the master branch rather than patched. Users should upgrade to OpenWrt versions that do not include luci-lib-px5g (master branch or later). Until then, avoid using the create_selfsigned() Lua interface or restrict access to it to trusted users only. Monitor vendor advisories for any future patches or official fixes.