CVE-2026-86509: D-Link DIR-895L Buffer Overflow Vulnerability

CVE-2026-86509 Overview

A stack-based buffer overflow affects D-Link DIR-895L A1_102b07 routers. The flaw resides in the sendOffer and sendACK functions within udhcpcd/serverpacket.c, part of the udhcpcd DHCP server component. An attacker on the adjacent local network can trigger the overflow by sending crafted DHCP packets that mishandle TR-111 Option 125 parsing. The exploit has been published publicly, increasing the risk of opportunistic abuse against exposed devices. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
An adjacent-network attacker can corrupt the DHCP server stack on affected DIR-895L routers, potentially achieving arbitrary code execution on the device and compromising the entire local network.

Affected Products

D-Link DIR-895L router (firmware version A1_102b07)
udhcpcd DHCP server component shipped with the affected firmware
Functions sendOffer and sendACK in udhcpcd/serverpacket.c

Discovery Timeline

2026-09-08 - CVE-2026-86509 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86509

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in the DHCP server (udhcpcd) shipped with D-Link DIR-895L firmware A1_102b07. The sendOffer and sendACK routines in serverpacket.c construct DHCP response packets that include TR-111 Option 125 (Vendor-Identifying Vendor-Specific Information). During this construction, option data is copied into a fixed-size stack buffer without adequate length validation.

When an attacker supplies oversized or malformed Option 125 content in a DHCP request, the response builder writes past the buffer boundary. This corrupts adjacent stack memory, including saved return addresses and frame pointers. Successful exploitation can lead to arbitrary code execution on the router with the privileges of the DHCP daemon. Refer to the Notion Stack Overflow Analysis for the full technical breakdown.

Root Cause

The root cause is missing bounds enforcement when copying attacker-controlled TR-111 Option 125 fields into a local stack buffer inside sendOffer and sendACK. The code trusts the length values embedded in the incoming DHCP option data. This aligns with the CWE-119 weakness class.

Attack Vector

Exploitation requires network adjacency. The attacker must be on the same broadcast domain as the router to interact with the DHCP service. A malicious client sends a DHCP DISCOVER or REQUEST containing a crafted Option 125 payload. The DIR-895L then invokes the vulnerable response function and overflows its stack buffer while building the OFFER or ACK reply. See the VulDB entry for CVE-2026-86509 for additional threat intelligence.

A proof-of-concept is publicly available, so weaponization does not require original exploit development.

Detection Methods for CVE-2026-86509

Indicators of Compromise

DHCP DISCOVER or REQUEST packets on the LAN containing unusually large or malformed Option 125 (TR-111 Vendor-Specific Information) fields.
Unexpected reboots, crashes, or restarts of the udhcpcd process on DIR-895L routers.
New or unauthorized outbound connections originating from the router management interface.
Rogue DHCP traffic sourced from unknown MAC addresses on trusted VLANs.

Detection Strategies

Deploy network sensors that parse DHCP options and flag Option 125 payloads exceeding expected lengths.
Baseline normal DHCP traffic per VLAN and alert on anomalous option structures or repeated malformed requests.
Correlate router log events (syslog from the DIR-895L) with LAN packet captures to detect crash-and-restart cycles indicative of exploitation attempts.

Monitoring Recommendations

Enable remote syslog forwarding from the router to a centralized log platform and monitor for DHCP daemon restarts.
Monitor administrative access to the router and alert on configuration changes made outside change windows.
Track ARP and DHCP lease anomalies that suggest an attacker has gained a foothold on the local segment.

How to Mitigate CVE-2026-86509

Immediate Actions Required

Inventory all D-Link DIR-895L devices and confirm firmware version; isolate any running A1_102b07.
Restrict physical and wireless access to segments served by affected routers to trusted users only.
Disable or replace the built-in DHCP server on the DIR-895L and delegate DHCP to a hardened server if operationally feasible.
Consider decommissioning the DIR-895L, which is an end-of-life product line, and migrating to a currently supported router.

Patch Information

No vendor patch is referenced in the published advisory data at the time of writing. Check the D-Link official website for security bulletins covering the DIR-895L. Given the product's age, an official fix may not be released, making replacement the most reliable remediation path.

Workarounds

Segment the router onto an isolated VLAN and block untrusted clients from reaching UDP port 67 on the LAN interface.
Enforce wireless network access controls (WPA3 or WPA2 with strong pre-shared keys) to limit adjacent-network exposure.
Deploy DHCP snooping on managed switches to drop rogue or malformed DHCP traffic before it reaches the router.
Disable unused router services and management interfaces to reduce the attack surface while planning replacement.

bash

# Example: block untrusted hosts from reaching the router's DHCP service
# using an upstream managed switch ACL (vendor syntax will vary)
access-list 150 deny udp any host <router-ip> eq 67
access-list 150 permit ip any any
interface vlan <user-vlan>
  ip access-group 150 in