# CVE-2026-55490: OpenWrt Emergency Access Daemon integer underflow in handle_send_a

Source: https://junglewise.ai/threats/cve-2026-55490-openwrt-emergency-access-daemon-integer-underflow-in-handle-send  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-55490 · Severity: medium · CVSS 6.5 · Published 2026-07-07

OpenWrt is a Linux-based operating system used in embedded devices like routers. A vulnerability in its Emergency Access Daemon (EAD) allows an attacker on the same local network to crash the service by sending a single specially crafted network packet. This disables the emergency recovery feature, potentially preventing administrators from regaining access to the device during a failure.

Technologies: [OpenWrt](https://junglewise.ai/threats/technologies/openwrt). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-55490 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55490 being exploited in the wild.

**How severe is CVE-2026-55490?** Medium severity, with a CVSS score of 6.5, published 7 July 2026.

**Which products and versions are affected?** OpenWrt < 25.12.5.

**Is there a fix for CVE-2026-55490?** A patch was published on 2026-07-01: OpenWrt v25.12.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55490 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-55490?** Check whether you run OpenWrt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow exists in the handle_send_a() function within ead.c of the Emergency Access Daemon. The vulnerability occurs when calculating the length of the SRP 'A' parameter: the code subtracts the size of a header from the message length provided in the packet. If the provided length is zero, the unsigned subtraction wraps to a large value, which is then treated as -1 when assigned to a signed integer. This bypasses a signed bounds check and is subsequently passed to memcpy() as a very large size_t value, leading to an out-of-bounds read and daemon crash. The attack is reachable via UDP port 56026 by an unauthenticated attacker on the local network segment. The issue is fixed in OpenWrt v25.12.5.

## Affected products

- OpenWrt OpenWrt < 25.12.5

## Timeline

- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-01: patched: OpenWrt v25.12.5 released
- 2026-07-07: disclosed: CVE-2026-55490 published to NVD

## References

- [https://github.com/openwrt/openwrt/commit/63c0767f3d02f7b10b0f0b5293366bd059a08ca5](https://github.com/openwrt/openwrt/commit/63c0767f3d02f7b10b0f0b5293366bd059a08ca5)
- [https://github.com/openwrt/openwrt/releases/tag/v25.12.5](https://github.com/openwrt/openwrt/releases/tag/v25.12.5)
- [https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw](https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw)

## Related threats

- [OpenWrt cgi-io path traversal in cgi-download and cgi-exec](https://junglewise.ai/threats/cve-2026-62947-openwrt-cgi-io-path-traversal-in-cgi-download-and-cgi-exec)
- [OpenWrt odhcpd and LuCI stored XSS via DHCPv6 hostname injection](https://junglewise.ai/threats/cve-2026-62948-openwrt-odhcpd-and-luci-stored-xss-via-dhcpv6-hostname-injection)
- [OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30872-openwrt-project-is-a-linux-operating-system-targeting-embedded)
- [OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30871-openwrt-project-is-a-linux-operating-system-targeting-embedded)
- [In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…](https://junglewise.ai/threats/cve-2025-20748-in-wlan-ap-driver-there-is-a-possible-out-of-bounds-write-due-to)