CVE-2026-30871 Details
Description
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer (name_buffer), which is then copied via an unbounded strcpy into a fixed 256-byte stack buffer when handling TYPE_PTR queries. The overflow is possible because dn_expand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \001), significantly inflating the expanded name beyond the stack buffer's capacity. A crafted DNS packet can exploit this expansion behavior to overflow the stack buffer, making the vulnerability reachable through normal multicast DNS packet processing. This issue has been fixed in versions 24.10.6 and 25.12.1.
A stack-based buffer overflow vulnerability has been identified in the mdns daemon of OpenWrt Project versions prior to 24.10.6 and 25.12.1. The issue arises in the parse_question function when processing PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). The vulnerability is triggered by DNS packets received on UDP port 5353, which are expanded by the dn_expand function into an 8096-byte global buffer. This expanded data is then copied into a fixed 256-byte stack buffer without proper bounds checking, allowing for a buffer overflow. The vulnerability takes advantage of dn_expand's handling of non-printable ASCII bytes, which are converted into multi-character octal representations, inflating the data beyond the stack buffer's capacity. As a result, a crafted DNS packet can exploit this behavior, leading to a stack buffer overflow during normal multicast DNS packet processing.
Users can upgrade to OpenWrt versions 24.10.6 or 25.12.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/openwrt/releases/tag/v24.10.6 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/releases/tag/v25.12.1 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/security/advisories/GHSA-7c3j-f7w2-p8f6 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt openwrt | < 24.10.6 >= 25.12.0, < 25.12.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |