CVE-2026-86509 is a critical stack-based buffer overflow vulnerability found in the D-Link DIR-895L router's udhcpcd component, affecting the sendOffer/sendACK functions in serverpacket.c. The vulnerability allows an attacker with local network access to manipulate the functions to trigger a stack-based buffer overflow. The vulnerability has a CVSS 4.0 score of 9.4, indicating high impact across multiple security properties. Exploit code has been published, but there is no vendor advisory or patch information available at this time.

Successful exploitation can lead to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service on the affected device. The attack requires local network access and does not require user interaction or privileges. The vulnerability impacts confidentiality, integrity, availability, and security capabilities at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the local network to trusted users only and monitor for exploit attempts. No official patch or workaround is currently documented.