Quick answers
- Is CVE-2026-55490 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55490 being exploited in the wild.
- How severe is CVE-2026-55490?
- Medium severity, with a CVSS score of 6.5, published 7 July 2026.
- Which products and versions are affected?
- OpenWrt < 25.12.5.
- Is there a fix for CVE-2026-55490?
- A patch was published on 2026-07-01: OpenWrt v25.12.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55490 attacked?
- It is attacked from the adjacent network, in an operating system.
- Am I affected by CVE-2026-55490?
- Check whether you run OpenWrt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer underflow exists in the handle_send_a() function within ead.c of the Emergency Access Daemon. The vulnerability occurs when calculating the length of the SRP 'A' parameter: the code subtracts the size of a header from the message length provided in the packet. If the provided length is zero, the unsigned subtraction wraps to a large value, which is then treated as -1 when assigned to a signed integer. This bypasses a signed bounds check and is subsequently passed to memcpy() as a very large size_t value, leading to an out-of-bounds read and daemon crash. The attack is reachable via UDP port 56026 by an unauthenticated attacker on the local network segment. The issue is fixed in OpenWrt v25.12.5.
Affected products
- OpenWrt OpenWrt < 25.12.5
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-01: patched: OpenWrt v25.12.5 released
- 2026-07-07: disclosed: CVE-2026-55490 published to NVD