openwrt fixed a pre-auth stack overflow in its dhcpv6 server back in june. the CVE only landed in nvd this morning, so nvd fed scanners are just now starting to flag it (CVE-2026-53921, 9.8 from github as CNA) odhcpd is the default dhcpv6/RA server on openwrt and runs as root. one unauthenticated dhcpv6 request overflows a stack buffer while the reply is built. the reporter calls code exec realistic since a lot of embedded builds ship without stack canaries or ASLR. whats public is crash reproducers. no known exploitation, not in KEV the 9.8 is scored AV:N but in practice its adjacent. stock openwrt only runs the dhcpv6 server on lan, and the default wan zone rejects inbound udp 547. so the attacker is anyone on a segment odhcpd serves: lan, guest wifi, iot vlans. openwrts own release notes say network-adjacent fixed in 25.12.5 (june 30) and 24.10.8 (july 26), along with a use-after-free (CVE-2026-53918) and a stack memory leak (CVE-2026-53920) in the same code. careful with the nvd text, it says patched in 25.12. 25.12.0 through 25.12.4 are still vulnerable where the exposure actually sits: - vendor firmware built on openwrt. plenty of routers and APs ship forks that trail upstream by months, and their version numbers wont tell u. ask whether their odhcpd has the june fixes - openwrt boxes nobody has touched since spring if u cant upgrade yet, turn the dhcpv6 server off on guest and other untrusted segments and run slaac only there https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496