CVE-2026-30871

The parse_question function processes PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa) received via UDP on port 5353 (multicast DNS). Data from the packet is first expanded by the dn_expand function into a global buffer of 8096 bytes, and then copied without length checking (unbounded strcpy) to a stack buffer of only 256 bytes. The key mechanism is that dn_expand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \001), which significantly increases the size of the expanded name, exceeding the stack buffer capacity. An attacker can craft a DNS packet sent over the multicast network that will trigger this expansion and overflow the stack buffer.

A successful attack allows an attacker to remotely execute arbitrary code (RCE) on the device without authentication, which can lead to complete takeover of the router or embedded device running OpenWrt, as well as violation of confidentiality, integrity, and availability of the entire network.

OpenWrt should be updated to version 24.10.6 or 25.12.1, in which the vulnerability has been fixed. Patches are available in the vendor's repositories at the addresses indicated in the references. As a temporary measure, it is worth considering restricting access to UDP port 5353 at the firewall level for untrusted network segments.

OpenWrt in all versions prior to 24.10.6 and 25.12.1 (embedded devices with mdns daemon listening on UDP port 5353)