Loading vulnerability…
Stack-based buffer overflow in D-Link DIR-822A DHCP processing
CVE-2026-86296 is a stack-based buffer overflow in the udhcpcd DHCP component of D-Link DIR-822A routers running firmware A_101. An unchecked strcpy operation copies attacker-controlled DHCP data into a fixed-size stack buffer, allowing oversized input to overwrite adjacent memory. The vulnerable processing reportedly involves TR-111 DHCP Option 125. An unauthenticated attacker on the local network can trigger the flaw with crafted DHCP packets without user interaction, causing service disruption or potentially arbitrary code execution. Public proof-of-concept exploit code is available. The complete affected hardware-revision and firmware scope remains unconfirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can corrupt stack memory, crash the DHCP daemon or router, and disrupt network services. Successful code execution could compromise the router's confidentiality, integrity, and availability, potentially enabling traffic interception, configuration manipulation, and further attacks against connected systems. Root-level execution has been reported but is not consistently established.
If you can’t patch tonight, do this now.
Isolate affected routers from untrusted network segments and restrict access to the DHCP service to trusted clients where operationally feasible. Prevent unnecessary Internet exposure, disable nonessential remote management, and restrict administrative interfaces to trusted systems. Management-interface restrictions alone do not eliminate the local-network DHCP attack vector.
Patch, then assume compromise.
No official fixed firmware was confirmed available at the time of the notices. Verify the exact router model, hardware revision, and installed firmware, and monitor the applicable regional D-Link support channel for a security update. Install only firmware intended for that hardware revision. Replace affected devices with supported hardware if a vendor fix is unavailable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.