# CVE-2026-53922: odhcpd integer underflow in DHCPv6 IA handling

Source: https://junglewise.ai/threats/cve-2026-53922-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-53922 · Severity: medium · CVSS 6.5 · Published 2026-10-12

odhcpd is a DHCPv6 and DHCPv4 server used by OpenWrt routers. An unauthenticated attacker on the same network can craft a malicious DHCPv6 RENEW packet that causes an integer underflow in the server's buffer handling, leading to a stack buffer overflow. This allows the attacker to crash the DHCPv6 service repeatedly, disrupting network connectivity until the service restarts, though no remote code execution has been observed.

Technologies: [OpenWrt Odhcpd](https://junglewise.ai/threats/technologies/odhcpd). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-53922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53922 being exploited in the wild.

**How severe is CVE-2026-53922?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** OpenWrt Odhcpd up to commit cfddd56.

**Is there a fix for CVE-2026-53922?** Yes: fixed in Commits c6792ba and d08dbcc and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53922 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-53922?** Check whether you run OpenWrt Odhcpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Commits c6792ba and d08dbcc and later

## Technical details

The vulnerability is an integer underflow in the dhcpv6_ia_handle_IAs() function triggered by crafting a RENEW packet with multiple IA_NA options. An unmatched IA causes a NOBINDING response larger than the remaining buffer space; subsequent subtraction from an unsigned size_t variable underflows, disabling length checks and permitting stack buffer overflow beyond the 512-byte pdbuf. Attack vector is network-adjacent with no authentication required; the stack canary protects against code execution but allows denial of service via repeated crashes.

## Affected products

- OpenWrt odhcpd up to commit cfddd56

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57](https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57)
- [https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8](https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8)

## Related threats

- [odhcpd out-of-bounds read in DHCPv6 self-loop detection](https://junglewise.ai/threats/cve-2026-55606-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd DHCPv6 stack buffer overflow in IA response handler](https://junglewise.ai/threats/cve-2026-53921-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd DHCPv6 IA parser stack buffer overread](https://junglewise.ai/threats/cve-2026-53920-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd heap-use-after-free in DHCPv6 IA handler](https://junglewise.ai/threats/cve-2026-53918-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)