CVE-2026-86296

CVE-2026-86296 is a remotely exploitable stack-based buffer overflow (CWE-121, CWE-119) in the strcpy call within the file udhcpcd/serverpacket.c, part of the udhcpcd DHCP component on the D-Link DIR-822A router running firmware A_101. An attacker triggers the flaw by sending crafted network data that is processed by the router's udhcpcd DHCP packet-handling code, overflowing a fixed-size stack buffer without requiring authentication or user interaction. Successful exploitation can crash the daemon or potentially allow arbitrary code execution, giving an attacker high-impact control over the device (high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 9.3). Only D-Link DIR-822A devices running the affected firmware A_101 are implicated by this advisory. The advisory notes the exploit has been publicly disclosed and may be utilized, though no dedicated public PoC is catalogued and the issue is not yet in CISA KEV; EPSS estimates a 1.3% probability of exploitation in the next 30 days.

What to do: Check the firmware version on any DIR-822A in your environment (the admin UI displays it) and, if it is A_101, monitor the D-Link support page for a fixed release, as the advisory does not specify a patched version. Until a fix is applied, minimize untrusted DHCP traffic reaching the WAN-facing component and consider prioritizing replacement of this older router given the critical severity. Watch for the issue's addition to CISA KEV or a rise in EPSS as signals of active exploitation.