CVE-2026-30872 Details
Description
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from name_buffer is copied via strcpy into a fixed 256-byte stack buffer, and then the reverse IPv6 request is extracted into a buffer of only 46 bytes (INET6_ADDRSTRLEN). Because the length of the data is never validated before this extraction, an attacker can supply input larger than 46 bytes, causing an out-of-bounds write. This allows a specially crafted DNS query to overflow the stack buffer in match_ipv6_addresses, potentially enabling remote code execution. This issue has been fixed in versions 24.10.6 and 25.12.1.
A stack-based buffer overflow vulnerability has been identified in the mdns daemon of OpenWrt umdns package, affecting versions prior to 24.10.6 and 25.12.1. The vulnerability arises in the match_ipv6_addresses function while processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. The issue occurs because the domain name is copied from a buffer into a fixed 256-byte stack buffer without proper length validation. This flaw allows an attacker to craft a DNS query that overflows the stack buffer, potentially leading to remote code execution.
Users can upgrade to OpenWrt versions 24.10.6 or 25.12.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/openwrt/releases/tag/v24.10.6 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/releases/tag/v25.12.1 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/security/advisories/GHSA-mpgh-v658-jqv5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt openwrt | < 24.10.6 >= 25.12.0, < 25.12.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |