Executive brief
LuCI is the web-based configuration interface for OpenWrt routers and network devices. The underlying luci-lib-px5g library contains a heap buffer overflow when generating digital certificates with 2040-bit RSA keys. An attacker with local access to the LuCI application or control over certificate generation parameters could trigger a memory corruption, potentially leading to service disruption or code execution depending on how the application embedding LuCI uses this functionality.
Technical details
The vulnerability is a heap-based buffer overflow in the ASN.1 encoding routine asn1_add_obj() within x509write.c. When signing a certificate with a 2040-bit RSA key (producing a 255-byte signature), the code miscalculates the allocation size for a BIT STRING structure. It computes the DER length encoding for 255 bytes but then writes 256 bytes (after prepending the unused-bits byte), requiring one additional DER length octet. This causes a 1-byte write beyond the allocated 259-byte heap buffer. The overflow is reachable through the public Lua API via create_selfsigned(), making it accessible if an application exposes certificate signing operations to untrusted callers. The vulnerability affects OpenWrt release branches 18.06 through 25.12; it has been removed (not patched) from the master branch.
Affected products
- OpenWrt LuCI OpenWrt 18.06 through 25.12
Timeline
- 2026-08-22: disclosed
- 2026-08-07: advisory: GitHub Security Advisory GHSA-jgc3-4q3p-g6xh published