Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer (name_buffer), which is then copied via an unbounded strcpy into a fixed 256-byte stack buffer when handling TYPE_PTR queries. The overflow is possible because dn_expand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \001), significantly inflating the expanded name beyond the stack buffer's capacity. A crafted DNS packet can exploit this expansion behavior to overflow the stack buffer, making the vulnerability reachable through normal multicast DNS packet processing. This issue has been fixed in versions 24.10.6 and 25.12.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 1 | Disclosure1 |
| 2026-03-20 | 2 | Disclosure2 |
| 2026-03-30 | 1 | Disclosure1 |
CVE-2026-30871 OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vu… https://www.cve.org/CVERecord?id=CVE-2026-30871
Post summary
The post announces CVE-2026-30871, a stack-based buffer overflow in OpenWrt's mdns daemon affecting releases prior to 24.10.6 and 25.12.1.
U might wanna check these out The "OpenWrt mDNS" Stack Overflow (CVE-2026-30871) This is the big one for today. A 9.8 Critical vulnerability was just disclosed affecting the mdns daemon on OpenWrt. •The Vulnerability: An attacker can send a specially crafted DNS packet (via UDP port 5353) that triggers a stack-based buffer overflow. •The Risk: Since mDNS is often enabled by default for "Easy Discovery" of devices on a local network, an attacker on your Wi-Fi (or a compromised device) could potentially gain full control of the router. The "NetScaler-Style" Memory Leak (CVE-2026-3055) While this specifically targets Citrix NetScaler, researchers today are reporting active "Reconnaissance" (probing) across the internet for similar memory-overread flaws in other gateway appliances. •This exploit allows unauthenticated attackers to "leak" sensitive data from the system's memory. Linux Kernel "Transparent Huge Pages" Flaw (CVE-2026-23375) Published just hours ago, this is a local privilege escalation flaw in the Linux kernel's memory management. •The Risk: It involves a logic flaw in how the kernel handles "Secret Memory" (secretmem). A local user could potentially crash the kernel or elevate their privileges.
Post summary
The statement announces three new CVEs affecting OpenWrt, Citrix NetScaler, and the Linux kernel, detailing their technical nature and potential impact while lacking any PoC, exploit, patch, or evidence of current exploitation.
🚨*CVE* CVE-2026-30871 OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vu… https://www.cve.org/CVERecord?id=CVE-2026-30871 ----- Traducción: CVE-2026-30871 Ope… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-30871, describing a stack-based buffer overflow in OpenWrt’s MDNS daemon for versions prior to 24.10.6 and 25.12.1, with no additional exploitation or mitigation details.
🚨 CVE-2026-30871: OpenWrt Project has Stack-based ... Octal expansion in dn_expand turns 1-byte payloads into 4-byte sequences, amplifying crafted PTR queries 32x to smash O... https://zerodaysignal.com/vulnerability/CVE-2026-30871 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2026-30871 is a stack‑based buffer overflow in the OpenWrt project caused by octal expansion in dn_expand, enabling 32× amplification of crafted PTR queries.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | openwrt | openwrt | - | - | - |