CVE-2026-100740 is an out-of-bounds write in the L2TP Control Channel Parser of D-Link DIR-895L firmware A1_102b07. It can be triggered remotely, is rated CVSS 3.1 9.9 (Critical), and a public exploit exists.
What Is It
The flaw is in the tunnel_set_params function in tunnel.c, which is part of the router's L2TP Control Channel Parser. VulDB is the CNA. According to VulDB, a crafted manipulation of this function causes an out-of-bounds write, and an attacker can start the attack remotely. The listed weaknesses are CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write). The researcher's write-up is titled "L2TP Host Name AVP Out-of-Bounds Write." That title points to the Host Name attribute-value pair as the input that triggers the bug.
Why It Matters
- CVSS 3.1: 9.9 Critical (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The attack works over the network, has low complexity, needs low privileges and no user interaction, and has a changed scope. - CVSS 4.0: 8.6 High. Exploit maturity is marked Proof-of-Concept.
- CVSS 2.0: 9.0 High.
- Public exploit: VulDB's CNA record says "the exploit is now public and may be used."
Memory corruption like this can fully compromise confidentiality, integrity and availability. Because the scope is changed, the damage can reach beyond the vulnerable component itself.
KEV status: At the time of writing, CVE-2026-100740 was not listed in CISA's Known Exploited Vulnerabilities catalog. That means CISA has not added it on the basis of confirmed exploitation in the wild. It does not mean exploitation isn't happening. A public exploit does not prove the bug is being exploited, but it does make attacks easier.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | D-Link |
| Product | DIR-895L |
| Affected version | A1_102b07 |
| Component | L2TP Control Channel Parser |
| CPE | cpe:2.3:h:d-link:dir-895l:*:*:*:*:*:*:*:* |
The record lists no other firmware versions or hardware revisions.
Patch Status
The source data does not mention a vendor patch, fixed firmware version or D-Link advisory. The only vendor reference is D-Link's homepage. The NVD entry lists the CVE record's status as "Received," which means NVD has not analyzed it yet. Because the CVE is not in the KEV catalog, CISA has not issued a required action for it.
Owners of the DIR-895L on firmware A1_102b07 should watch D-Link for firmware updates or advisories. Until a fix is confirmed, they should limit who can reach the L2TP service.