# CVE-2026-53918: odhcpd heap-use-after-free in DHCPv6 IA handler

Source: https://junglewise.ai/threats/cve-2026-53918-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-53918 · Severity: info · Published 2026-10-23

odhcpd is the DHCPv6 and router-advertisement server that manages IPv6 address assignment in OpenWrt routers. An attacker on an adjacent network can send specially crafted DHCPv6 requests to trigger a memory error that allows them to corrupt DHCPv6 authentication keys, disrupting IPv6 client configuration and potentially enabling man-in-the-middle attacks on network renewal commands.

Technologies: [OpenWrt Odhcpd](https://junglewise.ai/threats/technologies/odhcpd). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-53918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53918 being exploited in the wild.

**How severe is CVE-2026-53918?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** OpenWrt Odhcpd before 25.12.

**Is there a fix for CVE-2026-53918?** Yes: fixed in 25.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53918 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-53918?** Check whether you run OpenWrt Odhcpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 25.12

## Technical details

A heap-use-after-free exists in odhcpd's DHCPv6 IA handler when processing multiple IA options in a single request message. The vulnerability occurs when a first IA sets a lease pointer that is later freed due to an on-link check failure; a subsequent IA in the same packet then reads from this freed pointer to copy a Reconfigure authentication key. The bug requires DHCPv6 REQUEST access from an adjacent network and produces a 16-byte read from freed memory, confirmed by AddressSanitizer and deterministically reproducible through careful packet crafting.

## Affected products

- OpenWrt odhcpd before 25.12

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93](https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93)
- [https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9](https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9)

## Related threats

- [odhcpd out-of-bounds read in DHCPv6 self-loop detection](https://junglewise.ai/threats/cve-2026-55606-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd DHCPv6 stack buffer overflow in IA response handler](https://junglewise.ai/threats/cve-2026-53921-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd DHCPv6 IA parser stack buffer overread](https://junglewise.ai/threats/cve-2026-53920-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd integer underflow in DHCPv6 IA handling](https://junglewise.ai/threats/cve-2026-53922-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)