CVE-2026-96891 is a remotely triggerable out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32, rated CVSS 3.1 9.8 (Critical) by VulDB.
What Is It
The flaw is in the tunnel_set_params function in tunnel.c, part of the router's rp-l2tp component. According to the CVE description, manipulating the peer_hostname argument causes an out-of-bounds write. The CNA maps it to CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The researcher's write-up is titled "D-Link DIR-825 L2TP Host Name AVP Out-of-Bounds Write."
VulDB ([email protected]) published the CVE on 2026-09-24. Its NVD status is "Received," which means NVD has not yet done its own analysis. All scores below come from the CNA.
Why It Matters
The CNA scores are:
- CVSS 3.1: 9.8 Critical (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 Critical
- CVSS 2.0: 10.0
The vector describes an attack over the network, with low complexity, no privileges and no user interaction. It carries high impact to confidentiality, integrity and availability. The description confirms the attack can be started remotely.
The CVE is not in CISA's Known Exploited Vulnerabilities (KEV) catalog, and the supplied sources do not confirm active exploitation. There is a public researcher write-up, so defenders should expect technical details to be available.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-825
- Affected version: 3.00b32
- Component: rp-l2tp (
tunnel.c,tunnel_set_params)
The only version listed as affected is 3.00b32. The CNA did not list any other versions.
Patch Status
The supplied sources do not mention a patch, fixed firmware version, or vendor advisory. There is no CISA KEV required action, because the CVE is not in the catalog. DIR-825 owners should check D-Link's site for firmware updates and follow the vendor's guidance when it is published.