Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-55606odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()

Medium 6.5

In plain English

A medium-severity security flaw in odhcpd from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
openwrt	odhcpd	<= 25.12

Weakness: CWE-126 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References

https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45 x_refsource_CONFIRM
https://github.com/openwrt/odhcpd/pull/401 x_refsource_MISC
https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f x_refsource_MISC
https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301 x_refsource_MISC