CVE-2026-62381: LuCI px5g Library Buffer Overflow Flaw

CVE-2026-62381 Overview

CVE-2026-62381 is a heap-based buffer overflow [CWE-122] in the luci-lib-px5g package used by OpenWrt's LuCI web interface. The flaw resides in the native ASN.1 encoding routine asn1_add_obj in x509write.c and triggers when signing a certificate with a 2040-bit RSA key. The allocation math undercounts DER length octets, causing a one-byte out-of-bounds write during the final memcpy. The bug is reachable through the Lua-exported create_selfsigned() function. The vulnerable code ships on the openwrt-18.06 through openwrt-25.12 release branches.

Critical Impact
A local authenticated attacker who can invoke certificate generation with a 2040-bit RSA key can corrupt heap memory adjacent to the ASN.1 output buffer, producing denial of service or potential further exploitation depending on the embedding application.

Affected Products

OpenWrt LuCI luci-lib-px5g on the openwrt-18.06 release branch
OpenWrt LuCI luci-lib-px5g on the openwrt-19.07 through openwrt-24.10 release branches
OpenWrt LuCI luci-lib-px5g on the openwrt-25.12 release branch

Discovery Timeline

2026-08-22 - CVE-2026-62381 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-62381

Vulnerability Analysis

The vulnerability is a classic off-by-one heap overflow in ASN.1 DER encoding. When luci-lib-px5g signs a certificate with a 2040-bit RSA key, the resulting signature is 255 bytes. The asn1_add_obj routine in x509write.c computes the BIT STRING allocation from the DER length encoding of that 255-byte payload. However, the code prepends a mandatory unused-bits byte before writing the signature, producing a 256-byte payload that requires an additional DER length octet.

The allocation reserves 259 bytes for the tag, length, unused-bits byte, and signature, while the actual write requires 260 bytes. The final memcpy writes one byte beyond the end of the heap buffer, corrupting adjacent heap metadata or data. The bug is absent from the master branch, where the luci-lib-px5g package has been removed entirely rather than patched.

Root Cause

The root cause is a mismatch between the length used to size the destination allocation and the length actually copied into that allocation. The allocator size is derived from the raw signature length before the unused-bits prefix is accounted for, so the DER length field grows by one octet without the buffer being resized accordingly.

Attack Vector

Exploitation requires the ability to invoke create_selfsigned() through the exported Lua interface with a 2040-bit RSA key. In a stock LuCI deployment this typically requires authenticated access to the web UI or shell access on the device. Remote exploitability depends entirely on whether an embedding application exposes this Lua function to untrusted input.

No verified public proof-of-concept code is available. Refer to the OpenWrt LuCI GitHub Security Advisory and the VulnCheck advisory on the heap overflow for technical details.

Detection Methods for CVE-2026-62381

Indicators of Compromise

Unexpected crashes or SIGABRT/SIGSEGV events from the uhttpd or LuCI process shortly after certificate generation requests.
LuCI audit log entries invoking create_selfsigned() with an RSA key size of 2040 bits, a non-standard value rarely produced by legitimate workflows.
Presence of the vulnerable luci-lib-px5g package on affected OpenWrt release branches.

Detection Strategies

Inventory OpenWrt devices and enumerate installed packages with opkg list-installed | grep luci-lib-px5g to identify vulnerable hosts.
Monitor LuCI request logs for POST requests to the certificate generation endpoints that specify unusual RSA key lengths.
Deploy runtime heap-protection tooling such as AddressSanitizer builds in test environments to confirm the one-byte overflow when reproducing the condition.

Monitoring Recommendations

Track process restarts and coredumps on OpenWrt gateways where LuCI is exposed.
Alert on repeated authentication or API calls that precede certificate signing operations from a single source.
Correlate device firmware version and installed package inventory with the affected release branches (openwrt-18.06 through openwrt-25.12).

How to Mitigate CVE-2026-62381

Immediate Actions Required

Restrict LuCI access to trusted management networks and enforce strong authentication for the web interface.
Remove or disable the luci-lib-px5g package on devices where certificate generation via LuCI is not required.
Audit any embedding applications that expose create_selfsigned() through the Lua interface to untrusted callers.

Patch Information

No backported patch has been released for the openwrt-18.06 through openwrt-25.12 branches at the time of publication. The luci-lib-px5g package has been removed from the master branch rather than patched. Track the OpenWrt LuCI GitHub Security Advisory GHSA-jgc3-4q3p-g6xh for updates on backports or replacement packages.

Workarounds

Uninstall the package with opkg remove luci-lib-px5g and use an alternative certificate generation workflow such as openssl on the device shell.
Reject requests that specify a 2040-bit RSA key size at a reverse proxy or WAF in front of LuCI.
Limit LuCI accounts authorized to invoke certificate generation to a minimum set of administrators.

bash

# Remove the vulnerable package on affected OpenWrt devices
opkg update
opkg remove luci-lib-px5g

# Verify removal
opkg list-installed | grep luci-lib-px5g