{"id":"CVE-2026-53918","aliases":[],"cve":{"records":[{"id":"CVE-2026-53918","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-11T15:46:12.315Z","published":"2026-10-23T13:21:00.665Z","modified":"2026-10-30T17:42:21.816Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T13:21:00.665Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:42:21.816Z"}],"references":[{"url":"https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-416","description":"CWE-416: Use After Free","source":"GitHub_M"},{"id":"CWE-672","description":"CWE-672: Operation on a Resource after Expiration or Release","source":"GitHub_M"},{"id":"CWE-825","description":"CWE-825: Expired Pointer Dereference","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:42:15.930203Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"odhcpd DHCPv6 IA dangling first pointer use-after-free","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.","score":8.8,"severity":"high","published":"2026-10-23T13:21:00.665Z","modified":"2026-10-30T17:42:21.816Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"openwrt","name":"odhcpd","platforms":[],"versions":[{"version":"< 25.12","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-53918"}],"remediation":[],"references":["https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2","https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93","https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9"],"sources":[{"name":"CVE","id":"CVE-2026-53918","modified":"2026-10-30T17:42:21.816Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-53918"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-30T18:28:16.909Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T18:50:31.969Z","attemptedAt":"2026-10-30T18:50:31.969Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T18:50:32.440Z","attemptedAt":"2026-10-30T18:50:32.440Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T18:50:32.100Z","attemptedAt":"2026-10-30T18:50:32.100Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T18:50:32.436Z","attemptedAt":"2026-10-30T18:50:32.436Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-53918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53918","modified":"2026-10-30T18:17:31.597","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T18:50:31.969Z"},{"source":"ENISA EUVD","id":"EUVD-2026-108969","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108969","modified":"Oct 23, 2026, 1:21:00 PM","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T18:50:32.100Z"},{"source":"FIRST EPSS","id":"CVE-2026-53918","url":"https://www.first.org/epss/","probability":0.00501,"percentile":0.42911,"date":"2026-10-30","checkedAt":"2026-10-30T18:50:32.436Z"}],"aiSummary":null}