External risk intelligence

OpenWrt mdns Stack Overflow Affects IPv6 PTR Queries

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-30872

The vulnerability involves multicast DNS (mDNS) traffic on UDP port 5353. mDNS is designed for local network service discovery and typically does not traverse internet gateways or routers. While it is network-reachable in some environments, public internet exposure of mDNS services is uncommon and generally restricted to the local link segment.

Remote Code Execution

Openwrt

before 24.10.625.12.0 to before 25.12.1

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the OpenWrt Project's mdns daemon could allow an attacker to execute arbitrary code by sending specially crafted DNS queries. This issue impacts devices running specific prior versions of the operating system and has been addressed in subsequent releases. The primary concern is to confirm if these affected systems are exposed and relevant to our environment.

Software component has a code execution flaw.
Confirms relevance and exposure for leadership.
Assess and address affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted multicast DNS queries over UDP port 5353 to a vulnerable device. The device's mDNS daemon, upon processing these queries, attempts to copy the IPv6 addresses from a PTR record into a fixed-size buffer without proper length validation. This causes a buffer overflow, potentially allowing the attacker to execute arbitrary code on the device.

Unauthenticated network access required.
Malformed PTR queries trigger overflow.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in the mdns daemon could allow a remote attacker to execute arbitrary code when processing specific IPv6 reverse DNS queries. This could affect the integrity and availability of the affected embedded device's services when exposed to untrusted multicast DNS traffic.

Embedded device services and functionality.
Malicious DNS query processing.
Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability likely falls to teams managing embedded device firmware or network infrastructure, such as infrastructure, platform, or network/security teams responsible for the OpenWrt devices. The first practical step is to identify all deployed OpenWrt instances, determine their reachability and business criticality, and then engage the accountable owners to plan remediation, which may involve vendor coordination or temporary risk reduction if immediate patching is not feasible.

Identify affected device owners.
Verify network exposure and criticality.
Plan remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OpenWrt mdns component affected by CVE-2026-30872?

OpenWrt is a specialized Linux operating system designed for embedded hardware like routers and networking gateways. The affected mdns daemon is a background process that enables service discovery, allowing devices to find each other on a network without manual configuration. This component is essential for modern home and small business connectivity, as it manages how devices resolve names and announce their presence to others.

Why does CVE-2026-30872 cause a stack-based buffer overflow?

This vulnerability, classified as CWE-121, occurs because the mdns daemon fails to check the size of incoming IPv6 reverse DNS queries before copying them into memory. It attempts to squeeze data larger than the allocated 46-byte limit into a fixed buffer. When an oversized query arrives, it spills over into adjacent memory on the stack, which can corrupt the program's execution flow and potentially allow an attacker to run unauthorized commands.

How is this OpenWrt buffer overflow triggered?

An attacker triggers the vulnerability by sending a maliciously crafted multicast DNS (mDNS) query to the device over UDP port 5353. The flaw is specifically tied to the processing of PTR records for IPv6 domains (.ip6.arpa). It is important to note that standard queries or traffic that does not contain these specific IPv6 reverse lookup structures will not trigger this memory corruption issue.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely because mDNS is designed for local network communication and typically does not traverse internet gateways. While the service listens on UDP port 5353, it is generally restricted to the local link segment. You should primarily focus on devices where untrusted entities might gain access to your local network, rather than concerns about direct exposure from the public internet.

What should I do if I am running affected OpenWrt versions?

First, locate all your OpenWrt instances and check their current firmware version against the 24.10.6 and 25.12.1 security releases. Since this is an embedded system, prioritize patching devices that manage your most critical network segments. If immediate updates are not possible, consider restricting access to the mDNS service or isolating vulnerable hardware from untrusted network traffic until you can apply the vendor's fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.