A stack buffer overflow in OpenWrt's DHCPv6 server can be triggered by any unauthenticated device on the local network, no user interaction required. CVE-2026-53921, rated critical, is one of over a dozen remotely exploitable vulnerabilities fixed in OpenWrt 24.10.8, released 2026-07-26. The affected service, odhcpd, ships enabled by default on every OpenWrt installation, meaning any unpatched router is exposed the moment it boots.

The odhcpd fixes alone cover seven distinct vulnerabilities including a use-after-free, a stack memory disclosure, and a pre-auth denial of service. A separate critical issue (CVE-2026-62948) chains odhcpd with LuCI: a rogue DHCPv6 client can inject a crafted hostname into the lease file, resulting in stored cross-site scripting on the admin web interface. The web server itself, uhttpd, received patches for three HTTP request smuggling flaws on keep-alive connections plus hardening for a one-byte overflow in URL decoding and constant-time password comparison. An ACL bypass in rpcd allowed symlink traversal to read or write arbitrary root-owned files, and cgi-io had its own path-traversal bug that exposed files like /etc/shadow.

Beyond the router's own services, the release pulls in upstream security fixes across the stack. The Linux kernel moves to 6.6.144, OpenSSL to 3.0.21 (nine CVEs), dnsmasq to 2.93, and dropbear backports fixes from upstream 2026.90 including a long-standing scp file-overwrite bug originally assigned CVE-2019-6111. The mac80211 wireless stack jumps from 6.12.61 to 6.12.96 with fixes for ath10k, ath11k, and rtw88 drivers, and hostapd picks up validation fixes for 802.11be multi-link element parsing. Optional packages in the feed also received major version bumps: curl to 8.19.0, PHP 8 to 8.3.32, Tor to 0.4.9.10, and haproxy to 3.0.25, though these require manual package updates on the device.

The 24.10 series is now in security-only maintenance with end of life projected for September 2026. The OpenWrt project recommends migrating to OpenWrt 25.12 before that deadline. One behavioral change worth noting: dropbear's scp -r now rejects recursive copies into an existing target directory as part of the CVE-2019-6111 fix, so scripts relying on that pattern will need to switch to rsync. Firmware images are available through the OpenWrt Firmware Selector or directly from the download server, and sysupgrade from 23.05 or any 24.10.x release is supported.