CVE-2026-55606
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Oct 23, 2026
CISA due date
—
The record
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before… CWE-126
- CVE-2026-57185 Asterisk is an open source private branch exchange and telephony toolkit. CWE-126
- CVE-2026-53920 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. CWE-126
- CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory… CWE-126
- CVE-2026-112404 Pillow is a Python imaging library. CWE-126
- CVE-2026-112394 Pillow is a Python imaging library. CWE-126
- CVE-2026-85745 MariaDB server is a community developed fork of MySQL server. CWE-126
- CVE-2026-85935 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose… CWE-126