PT-2026-56265 · Openwrt · Openwrt

Vasco0X4 · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-55490

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle send a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-55490

Affected Products

Openwrt

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-55490 · Security Note
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5 · Note
• https://github.com/openwrt/openwrt/commit/63c0767f3d02f7b10b0f0b5293366bd059a08ca5 · Note
• https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw · Note