CVE-2026-7853 is a critical remote buffer overflow vulnerability in the D-Link DI-8100 router firmware version 16.07.26A1. The issue arises from improper handling of the enable/time argument in the sprintf function of the /auto_reboot.asp HTTP handler, allowing an attacker to overflow a buffer remotely. The vulnerability requires no privileges or user interaction and has a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation. Public exploit code is available, increasing the risk of attacks. No official patch or remediation has been released by D-Link at the time of this report.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device due to buffer overflow. The attacker can trigger this remotely without authentication or user interaction. Given the critical CVSS score and public availability of exploit code, affected devices are at significant risk if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider restricting access to the device's management interface from untrusted networks and monitor for unusual activity. No official vendor mitigation or workaround has been provided.