# CVE-2026-62381: OpenWrt LuCI heap buffer overflow in ASN.1 certificate signing

Source: https://junglewise.ai/threats/cve-2026-62381-openwrt-luci-heap-buffer-overflow-in-asn-1-certificate-signing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62381 · Severity: medium · CVSS 6.6 · Published 2026-08-22

LuCI is the web-based configuration interface for OpenWrt routers and network devices. The underlying luci-lib-px5g library contains a heap buffer overflow when generating digital certificates with 2040-bit RSA keys. An attacker with local access to the LuCI application or control over certificate generation parameters could trigger a memory corruption, potentially leading to service disruption or code execution depending on how the application embedding LuCI uses this functionality.

Technologies: [OpenWrt LuCI](https://junglewise.ai/threats/technologies/luci). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-62381 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62381 being exploited in the wild.

**How severe is CVE-2026-62381?** Medium severity, with a CVSS score of 6.6, published 22 August 2026.

**Which products and versions are affected?** OpenWrt LuCI OpenWrt 18.06 through 25.12.

**Is there a fix for CVE-2026-62381?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62381 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-62381?** Check whether you run OpenWrt LuCI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap-based buffer overflow in the ASN.1 encoding routine asn1_add_obj() within x509write.c. When signing a certificate with a 2040-bit RSA key (producing a 255-byte signature), the code miscalculates the allocation size for a BIT STRING structure. It computes the DER length encoding for 255 bytes but then writes 256 bytes (after prepending the unused-bits byte), requiring one additional DER length octet. This causes a 1-byte write beyond the allocated 259-byte heap buffer. The overflow is reachable through the public Lua API via create_selfsigned(), making it accessible if an application exposes certificate signing operations to untrusted callers. The vulnerability affects OpenWrt release branches 18.06 through 25.12; it has been removed (not patched) from the master branch.

## Affected products

- OpenWrt LuCI OpenWrt 18.06 through 25.12

## Timeline

- 2026-08-22: disclosed
- 2026-08-07: advisory: GitHub Security Advisory GHSA-jgc3-4q3p-g6xh published

## References

- [https://github.com/openwrt/luci](https://github.com/openwrt/luci)
- [https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh](https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh)

## Related threats

- [OpenWrt LuCI mount configuration ACL permission escalation](https://junglewise.ai/threats/cve-2026-72840-openwrt-luci-mount-configuration-acl-permission-escalation)
- [OpenWrt luci-app-banip improper input validation in log parser](https://junglewise.ai/threats/cve-2026-62184-openwrt-luci-app-banip-improper-input-validation-in-log-parser)
- [OpenWrt LuCI stored XSS in DHCPv6 lease status tables](https://junglewise.ai/threats/cve-2026-61876-openwrt-luci-stored-xss-in-dhcpv6-lease-status-tables)