CVE-2026-30871 openwrt CVE debrief

Who should care

Defenders responsible for OpenWrt-based systems, particularly those using versions prior to 24.10.6 and 25.12.1, should assess exposure and prioritize patching. This includes verifying OpenWrt version and patch level, and monitoring DNS packet processing for potential exploitation attempts. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A critical vulnerability in OpenWrt's mdns daemon can be triggered by PTR queries for reverse DNS domains, allowing potential remote code execution. Defenders should prioritize patching vulnerable versions.

• Potential remote code execution through crafted DNS packets
• Verification of OpenWrt version and patch level is necessary
• Exposure to multicast DNS packet processing may be affected
• Remediation requires updating to fixed OpenWrt versions

Technical summary

The mdns daemon in OpenWrt has a stack-based buffer overflow vulnerability in the parse_question function, triggered by PTR queries for reverse DNS domains. The issue is caused by the expansion of DNS packets received on UDP port 5353 into an 8096-byte global buffer, which is then copied into a fixed 256-byte stack buffer when handling TYPE_PTR queries. This overflow is possible because dn_expand converts non-printable ASCII bytes into multi-character octal representations, significantly inflating the expanded name beyond the stack buffer's capacity.

Defensive priority

Defenders should prioritize patching vulnerable OpenWrt versions, as the vulnerability is reachable through normal multicast DNS packet processing.

Recommended defensive actions

• Patch OpenWrt versions prior to 24.10.6 and 25.12.1
• Verify and apply vendor-provided fixes
• Monitor DNS packet processing for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is caused by the expansion of DNS packets received on UDP port 5353 into an 8096-byte global buffer, which is then copied into a fixed 256-byte stack buffer when handling TYPE_PTR queries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.