Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck
CVE-2026-62381luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow
Medium 6.6
In plain English
A medium-severity heap buffer overflow in luci from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched.
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
References
- GitHub Security Advisory (GHSA-jgc3-4q3p-g6xh) vendor-advisory
- VulnCheck Advisory: luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow third-party-advisory