CVE-2026-86510: Out-of-bounds Write in D-Link DIR-822A

This vulnerability in D-Link DIR-822A's L2TP Control Message Parser component arises from improper handling in the tunnel_set_params function, leading to an out-of-bounds write condition. The flaw can be triggered remotely without user interaction and requires low attack complexity and privileges. The CVSS 4.0 vector indicates high impact on confidentiality, integrity, and availability, with partial scope change. Public exploit information exists, but no confirmed active exploitation is reported.

Successful exploitation could allow remote attackers to write outside intended memory bounds, potentially causing system crashes, data corruption, or execution of arbitrary code. The vulnerability affects confidentiality, integrity, and availability of the device. Given the critical severity and remote attack vector, affected devices could be severely compromised if exploited.

No official patch or remediation is currently available from the vendor. Users should monitor D-Link advisories for updates. Until a fix is released, consider restricting access to the affected device's management interfaces from untrusted networks to reduce exposure.