Unauthenticated CVSS 10.0 Buffer Overflow Reported in D-Link DIR-822A Routers

D-Link is investigating two critical flaws reported in DIR-822A routers running firmware A_101. CVE-2026-86296 is an unauthenticated, network-reachable stack-based buffer overflow in the udhcpcd component, rated CVSS 10.0, that could enable denial of service or remote code execution. A public proof-of-concept exploit has reportedly been released.

The second issue, CVE-2026-86510, is an out-of-bounds write in the L2TP Control Message Parser, rated 9.9 under CVSS v3.1 and requiring low privileges but no user interaction; public exploit code has also reportedly been released. D-Link has not confirmed the complete affected hardware-revision or regional scope, nor whether remediation is available. Organizations should verify deployed router models and firmware, disable unnecessary remote management, restrict administrative access, and monitor regional D-Link support channels for updates.