Quick answers
- Is CVE-2026-53918 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-53918 being exploited in the wild.
- How severe is CVE-2026-53918?
- Informational severity, published 23 October 2026.
- Which products and versions are affected?
- OpenWrt Odhcpd before 25.12.
- Is there a fix for CVE-2026-53918?
- Yes: fixed in 25.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-53918 attacked?
- It is attacked from the adjacent network, in a hosted service.
- Am I affected by CVE-2026-53918?
- Check whether you run OpenWrt Odhcpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 25.12
Technical details
A heap-use-after-free exists in odhcpd's DHCPv6 IA handler when processing multiple IA options in a single request message. The vulnerability occurs when a first IA sets a lease pointer that is later freed due to an on-link check failure; a subsequent IA in the same packet then reads from this freed pointer to copy a Reconfigure authentication key. The bug requires DHCPv6 REQUEST access from an adjacent network and produces a 16-byte read from freed memory, confirmed by AddressSanitizer and deterministically reproducible through careful packet crafting.
Affected products
- OpenWrt odhcpd before 25.12
Timeline
- 2026-10-23: disclosed