A DHCP service that many routers trust by default can become a root code path when it parses attacker-controlled requests. In this case, a crafted DHCPv6 REQUEST can overflow odhcpd’s stack buffer, and the advisory says typical embedded devices often lack the hardening that would blunt code execution.
OpenWrt fixed CVE-2026-53921 in 24.10.8 and 25.12.5. The bug affects odhcpd, which runs as root, and the advisory includes public proof-of-concept code, so this is a practical exploit path on consumer gateways and small-office gear that exposes DHCPv6 on the local network.
The risk is not just a crash in the DHCP daemon. If the overflow is reached, the attacker can gain root on the router itself, which puts network behavior for every client behind it under attacker control and leaves a trusted foothold in the infrastructure.