# OpenWrt 25.12.5 Fixes a Critical Remotely Triggerable Flaw in odhcpd

- **Published on:** 2026-07-18
- **Category:** Security
- **Original page:** https://linuxgratis.com/en/articles/openwrt-25-12-5

The fifth service release of OpenWrt 25.12 patches several vulnerabilities in network services enabled by default, including CVE-2026-53921, a critical buffer overflow in odhcpd.

---

In late June 2026 the [OpenWrt](/en/openwrt) project released **25.12.5**, the fifth service release of the 25.12 stable series. This is not a feature release: it is one of those you install without thinking twice, because it patches **several remotely triggerable vulnerabilities in network services that ship enabled by default**. The announcement explicitly recommends updating.

## The big one: CVE-2026-53921

The centrepiece is **CVE-2026-53921**, rated **critical**: a stack buffer overflow in the DHCPv6 IA reply serialization inside **odhcpd**, the daemon OpenWrt uses as its DHCPv6, DHCPv4 and router advertisement (RA) server. It is triggered with crafted **DHCPv6 REQUEST** packets.

In practical terms: this is a component that listens on the local network by default and processes packets before any authentication. On a router, that is precisely the worst possible combination.

And it does not come alone. The same revision fixes further problems in odhcpd:

- A **use-after-free** in the DHCPv6 IA handler.
- A **stack memory disclosure** via truncated DHCPv6 options.
- A **pre-authentication denial of service**.

## Known issues

The announcement also lists a few open items worth keeping on the radar before updating a large deployment:

- **Pixel 10** phones have trouble connecting to WPA3-protected WiFi 6 access points.
- **802.11r Fast Transition** causes connection problems with some WiFi clients when WPA3 is in use.
- **SQM CAKE MQ** throughput may be unexpectedly low on some configurations after the scheduler fixes.

## Context: the 25.12 series

It helps to remember where this branch comes from. **25.12.0**, released in March 2026, was a significant step for OpenWrt: it introduced a **new package manager**, added a **built-in upgrade tool** and extended support to more than **2,200 devices**. Revisions .1 through .5 are the usual bedding-in of a stable series, and this fifth one is clearly the most urgent of the lot.

## What to do

Update, sooner rather than later. A router is a device that is always on, always exposed and rarely thought about — which is exactly why pre-auth flaws in its network daemons are such attractive targets. You can do it from LuCI, under System → Backup / Flash Firmware, or with `sysupgrade` from the shell. If you manage several units, prioritise those running odhcpd facing untrusted segments.

The details are in the [official OpenWrt 25.12.5 announcement](https://lists.openwrt.org/pipermail/openwrt-announce/2026-June/000088.html) and the [full 25.12.5 changelog](https://openwrt.org/releases/25.12/changelog-25.12.5). Versions and support lifecycle are on the [OpenWrt page](/en/openwrt).