Cyber & AI intelligence
Wasteland.
Briefs indexed2459
Issues27
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-86296 2026-09-07

CVE-2026-86296: Critical Unauthenticated Stack Overflow in D-Link DIR-822A

"A stack-based buffer overflow in the DHCP handling code of the D-Link DIR-822A (firmware A_101) can be triggered remotely without authentication, and a public exploit disclosure already exists."

A stack-based buffer overflow in the DHCP handling code of the D-Link DIR-822A (firmware A_101) can be triggered remotely without authentication, and a public exploit disclosure already exists.

What Is It

CVE-2026-86296 is a stack-based buffer overflow in D-Link DIR-822A A_101. The NVD record places the flaw in a strcpy call in udhcpcd/serverpacket.c and names the affected component as udhcpcd. Attacker-controlled input reaches that copy without adequate bounds checking, corrupting the stack.

The component naming in the supplied record is not internally consistent, and readers should treat it with caution. udhcpcd is conventionally the BusyBox-style DHCP client, yet serverpacket.c is a server-side source file, and the researcher writeup credited in the references describes a stack overflow in udhcpd, the DHCP server, while parsing the TR-111 Option 125 vendor-specific field. Whether the vulnerable code path is client-side or server-side therefore is not settled by the supplied data, and that distinction determines who can reach it: a DHCP server bug is reachable by hosts that can send DHCP requests to the device, while a client-side bug requires the router to process a malicious DHCP response. Until the vendor or NVD analysis resolves the naming, defenders should assume both DHCP paths on the device warrant attention.

The vulnerability is classified under CWE-121 (stack-based buffer overflow) and CWE-119 (improper restriction of operations within the bounds of a memory buffer). It was assigned by VulDB ([email protected]) and published on 2026-09-07.

Why It Matters

The CVSS v3.1 base score is 10.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, and a changed scope with full confidentiality, integrity, and availability impact. The CVSS v4.0 score is 9.3 (CRITICAL) with an exploit maturity of PROOF_OF_CONCEPT; CVSS v2.0 rates it 10.0 with complete impact across all three properties.

NVD notes that the attack can be carried out remotely and that the exploit has been publicly disclosed and may be utilized. That combination, no authentication required plus available exploit details, meaningfully lowers the bar for opportunistic attacks against exposed devices. Note that the AV:N rating is inherited from the supplied scoring data; if the vulnerable code is the DHCP server path described in the researcher writeup, practical reachability is likely to be adjacent-network rather than internet-wide, since DHCP traffic is not typically routed across network boundaries.

This CVE does not appear in the supplied CISA KEV data, so there is no KEV confirmation of active exploitation at this time.

What's Vulnerable

No other products or firmware versions are listed in the supplied record.

Patch Status

The supplied NVD record lists no patch, fixed version, or vendor advisory, and includes no CISA KEV required action or remediation deadline. The only vendor reference provided is D-Link's main website. NVD status is "Received," meaning the entry has not yet completed analysis; which is also why the component attribution above should be revisited once analysis finishes. Operators should treat exposed DIR-822A A_101 units as unpatched pending vendor guidance.

Sources