---
cve: "CVE-2026-30872"
severity: "CRITICAL"
cvss: 9.5
epss: "2.2%"
vendor: "OpenWRT"
kev: false
exploited: false
published: "2026-03-19 22:16:31"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T10:59:50+02:00"
---

# CVE-2026-30872

> 9.5 CRITICAL · 🧪 PoC

## Beschreibung

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from name_buffer is copied via strcpy into a fixed 256-byte stack buffer, and then the reverse IPv6 request is extracted into a buffer of only 46 bytes (INET6_ADDRSTRLEN). Because the length of the data is never validated before this extraction, an attacker can supply input larger than 46 bytes, causing an out-of-bounds write. This allows a specially crafted DNS query to overflow the stack buffer in match_ipv6_addresses, potentially enabling remote code execution. This issue has been fixed in versions 24.10.6 and 25.12.1.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- d6115e42127481645ae7210c9d8ca1bd14313473 (Commit)
- ec8eeaa8fbd3122b9b9e68b7db02707884a19c9c (Commit)

## Referenzen

- <https://github.com/openwrt/openwrt/security/advisories/GHSA-mpgh-v658-jqv5>
- <https://github.com/openwrt/openwrt/releases/tag/v24.10.6>
- <https://github.com/openwrt/openwrt/releases/tag/v25.12.1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-30872) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_