A publicly disclosed out-of-bounds write in the D-Link DIR-822A router's L2TP control message parser could allow a remote, low-privileged attacker to corrupt memory in a network-facing service, and is scored 9.9 CRITICAL under CVSS 3.1. The identifier itself warrants verification before this entry is used operationally: CVE-2026-86510 falls well outside the ID range currently observed in 2026 assignments, so readers should confirm the identifier against NVD or the CVE Program record before wiring it into tracking or ticketing.
What Is It
CVE-2026-86510 is described as an out-of-bounds write (CWE-787, CWE-119) in the tunnel_set_params function of the L2TP Control Message Parser component on the D-Link DIR-822A. Manipulation of the parsed input drives a write outside intended memory bounds. The attack can be launched remotely, and per the NVD record, the exploit has been disclosed to the public and may be used.
The record carries a CVSS 3.1 base score of 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. A separate CVSS 4.0 assessment rates it 8.6 HIGH with exploit maturity marked PROOF_OF_CONCEPT.
Why It Matters
The combination of network reachability, low attack complexity, no user interaction, and a scope change means a successful write can affect components beyond the vulnerable one. Memory corruption in a network-facing protocol parser on an embedded router is the class of flaw that has repeatedly been developed into device takeover, though the available material does not demonstrate reliable code execution here; the scoring reflects assessed impact, not a verified end-to-end exploit chain. Public disclosure of the exploit lowers the barrier for opportunistic use.
The source material supplied for this entry contains no KEV record, and we have not independently confirmed the catalog's contents for this CVE; absence of a KEV entry in the material at hand is not itself evidence that CISA has evaluated and excluded it, and it says nothing about in-the-wild activity either way. Check the CISA KEV catalog directly if catalog status drives your remediation timeline. The publicly available proof of concept still warrants prompt attention independent of that status.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-822A (hardware)
- Affected version: A_101
- Affected component: L2TP Control Message Parser, function
tunnel_set_params - CPE:
cpe:2.3:h:d-link:dir-822a:*:*:*:*:*:*:*:*
Patch Status
The supplied source material lists no vendor advisory, patched firmware version, or fix availability. The NVD record's vulnerability status is Deferred, and no required remediation action is specified. The only vendor reference provided is D-Link's main website; consult D-Link directly for firmware guidance on the DIR-822A. In the absence of a fix, restricting L2TP reachability from untrusted networks is the practical mitigation.