# CVE-2026-53920: odhcpd DHCPv6 IA parser stack buffer overread

Source: https://junglewise.ai/threats/cve-2026-53920-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-53920 · Severity: info · Published 2026-10-23

odhcpd is a DHCP and router-advertisement server used in OpenWrt routers to assign IP addresses to connected devices. An attacker on the local network can send malformed DHCP requests to trigger a buffer overread, allowing them to leak sensitive memory contents like stack canaries and address layout information used by security protections. This information leakage can enable further attacks to compromise the router.

Technologies: [OpenWrt Odhcpd](https://junglewise.ai/threats/technologies/odhcpd). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-53920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53920 being exploited in the wild.

**How severe is CVE-2026-53920?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** OpenWrt Odhcpd 17.01.0 to before 25.12.3.

**Is there a fix for CVE-2026-53920?** Yes: fixed in 25.12.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53920 attacked?** It is attacked over the network or from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-53920?** Check whether you run OpenWrt Odhcpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 25.12.3

## Technical details

The DHCPv6 IA option parser reads the IAID field from the option payload without first validating that the option body is at least 12 bytes (as required by RFC8415). A crafted IA_NA or IA_PD option shorter than 12 bytes causes an out-of-bounds read from the adjacent stack buffer, with the leaked bytes reflected in the DHCPv6 reply. This enables an unauthenticated network-adjacent attacker to extract stack canaries and ASLR-relevant contents.

## Affected products

- OpenWrt odhcpd 17.01.0 to before 25.12.3

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2](https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2)
- [https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42](https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42)

## Related threats

- [odhcpd out-of-bounds read in DHCPv6 self-loop detection](https://junglewise.ai/threats/cve-2026-55606-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd DHCPv6 stack buffer overflow in IA response handler](https://junglewise.ai/threats/cve-2026-53921-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd heap-use-after-free in DHCPv6 IA handler](https://junglewise.ai/threats/cve-2026-53918-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd integer underflow in DHCPv6 IA handling](https://junglewise.ai/threats/cve-2026-53922-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)