CVE-2026-38821

openNDS, an open-source captive portal daemon typically run on routers and gateways to handle guest Wi-Fi logins, contains a heap-based buffer overflow (CWE-122) in http_microhttpd.c affecting all versions before 11.0.0. An unauthenticated attacker connected to the captive portal network can send crafted requests that corrupt heap memory, crashing the openNDS daemon and potentially executing code on the device. Because the attack complexity is rated high, remote code execution is plausible but not guaranteed; denial of service is the certain impact. Any deployment running openNDS prior to 11.0.0 is affected, with the attacker needing adjacency to the portal network rather than generic internet access. No public proof-of-concept or known exploitation exists, and EPSS estimates only about a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade to openNDS 11.0.0 or later, which fixes the overflow in http_microhttpd.c. Until upgraded, restrict the captive portal network to trusted clients, monitor the openNDS daemon for crashes, and enable automatic restart as a stopgap. Check whether your router or gateway firmware bundles openNDS and whether the captive portal service is actually enabled before prioritizing patching.