odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
Impact
odhcpd versions 25.12 and prior have a stack buffer overread vulnerability via DUID length endianness mismatch in memcmp(). An unauthenticated attacker can trigger a 2560-byte overread from a 128-byte buffer with a single DHCPv6 packet.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
openwrt · GitHub_M
odhcpd
1 range
openwrt · GitHub_M
odhcpd
Compare with this publisher’s ranges. This does not inspect your installation.
affected
<= 25.12
Other versions: unknown
Original source description
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-55606View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.