Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-86509 2026-09-07

CVE-2026-86509: Stack Overflow in D-Link DIR-895L DHCP Server Code

"A published proof-of-concept exploit targets a stack-based buffer overflow in the udhcpd component of the D-Link DIR-895L router. The documented effect is memory corruption on the stack, reachable by an unauthenticated…"

A published proof-of-concept exploit targets a stack-based buffer overflow in the udhcpd component of the D-Link DIR-895L router. The documented effect is memory corruption on the stack, reachable by an unauthenticated attacker on the local network; whether that corruption can be driven to full device compromise has not been publicly demonstrated.

What Is It

CVE-2026-86509 is a stack-based buffer overflow (CWE-121, CWE-119) in D-Link DIR-895L firmware A1_102b07. The flaw resides in the sendOffer/sendACK functions of udhcpd/serverpacket.c, part of the router's DHCP server daemon. According to the advisory, manipulation of the affected input triggers memory corruption on the stack. The attack can only be carried out from within the local network. Per the assigning CNA (VulDB), the exploit has been published and may be used.

Why It Matters

The CVSS v3.1 base score is 9.6 (CRITICAL), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, adjacent-network attack vector, low complexity, no privileges, and no user interaction required, with a changed scope and high impact to confidentiality, integrity, and availability. Under CVSS v4.0 the same issue is scored 8.6 (HIGH) with an exploit maturity of Proof-of-Concept. The changed scope in the v3.1 assessment reflects a judgment that compromise of the DHCP service could affect components beyond the vulnerable process itself, significant for a device that sits at the network edge and services every client on the LAN. Note that these scores describe assessed worst-case impact rather than verified outcomes. Because the code path is in DHCP offer/ACK handling, a malicious device that joins the network, a rogue laptop, a compromised IoT endpoint, or a guest on shared Wi-Fi; would likely be able to reach it without credentials.

What's Vulnerable

Patch Status

No CISA KEV entry accompanies this CVE, so there is no federally mandated remediation deadline and no confirmation of exploitation in the wild; though a public exploit exists. The NVD record remains in "Received" status, meaning it has not yet been through NVD analysis, and it lists no vendor patch or fixed version. The only vendor reference supplied is D-Link's main site; consult it for current firmware and end-of-life guidance for this model.

Sources