D-Link DIR-895L udhcpcd Stack-Based Buffer Overflow
First seen Sep 10, 2026 · Updated Sep 10, 2026 · CVSS 9.6
A critical stack-based buffer overflow vulnerability affects the udhcpcd component of D-Link DIR-895L routers running firmware A1_102b07, specifically within the sendOffer/sendACK functions of serverpacket.c. The flaw is exploitable only by attackers on the local network, but a public exploit is available, significantly increasing the risk of exploitation. Successful exploitation could allow attackers to crash the device or achieve remote code execution on the router.
Technical Analysis
CVE-2026-86509 arises from improper bounds checking in the sendOffer and sendACK functions within udhcpcd's serverpacket.c, allowing an attacker on the same local network to send crafted DHCP packets that overflow a stack-based buffer. This can lead to denial of service or arbitrary code execution on the router with elevated privileges, given the CVSS score of 9.6. Since exploitation requires local network access, the primary attack vector is a compromised or malicious device already inside the network, or an attacker who has gained initial LAN access via another vector (e.g., compromised IoT device, malicious insider, or Wi-Fi compromise). No authentication is required once network access is obtained, and public exploit code lowers the barrier for weaponization. For organizations running AI agent infrastructure on local networks behind affected D-Link routers, compromise of the router could enable traffic interception, DNS/MITM manipulation, or pivoting to internal hosts running agent frameworks, RAG pipelines, or API-key-holding services, exposing credentials and enabling downstream agent-relevant attacks.
Affected Systems
D-Link DIR-895L router, firmware version A1_102b07, udhcpcd component (serverpacket.c)
Indicators of Compromise
- No specific hashes, IPs, or domains published; indicators are anomalous DHCP traffic (malformed sendOffer/sendACK packets) targeting udhcpcd on affected devices
Remediation Steps
- 1
Apply firmware update
Check D-Link's support site for a patched firmware release addressing CVE-2026-86509 and apply it immediately; if unavailable, monitor for vendor advisories.
- 2
Segment and restrict LAN access
Limit local network access to trusted devices only, implement VLAN segmentation, and disable unnecessary DHCP server functionality if not required.
- 3
Monitor DHCP traffic
Deploy network monitoring to detect anomalous or malformed DHCP packets targeting the router's udhcpcd service.
- 4
Replace end-of-life hardware
If D-Link DIR-895L has reached end-of-life and no patch is issued, replace the device with actively supported hardware.
- 5
Restrict physical/wireless network access
Harden Wi-Fi credentials and disable guest network access to reduce the risk of unauthorized local network presence.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.