CVE-2026-30871 is a critical stack based buffer overflow (CVSS 9.8) in the OpenWrt mdns daemon, in versions before 24.10.6 and 25.12.1. A crafted multicast DNS packet can trigger it. Upgrade to OpenWrt 24.10.6 or 25.12.1.
What's affected
OpenWrt versions before 24.10.6 and before 25.12.1 are affected. The fixed releases are 24.10.6 and 25.12.1.
The bug is in the parse_question function of the mdns daemon and is triggered by PTR queries for reverse DNS domains ending in .in-addr.arpa and .ip6.arpa.
How to check if you're exposed
Read the release on the device:
cat /etc/openwrt_release
Then see whether the mdns daemon is running:
ps | grep -i mdns
Any router on a release before 24.10.6 (24.10 line) or 25.12.1 (25.12 line) that runs the daemon and receives multicast DNS on UDP port 5353 should be treated as exposed.
What to do now
- Upgrade the device to OpenWrt 24.10.6 or 25.12.1 or later.
- If you cannot upgrade yet, read the advisory for any mitigation it lists, and avoid letting untrusted hosts send multicast DNS to the router.
- Keep guest and IoT networks separate from the segment that the router listens on.
- Track which of your devices run OpenWrt, including ones built into other products, and check each vendor for a rebuilt image.
Why it matters
The weakness class is CWE-121, stack based buffer overflow. Incoming names are expanded into an 8096 byte global buffer and then copied with an unbounded strcpy into a 256 byte stack buffer. The expansion turns non printable bytes into longer octal escapes, which inflates the name past the smaller buffer.
The record says this is reachable through normal multicast DNS packet processing, which is why the severity is high. Routers sit at the edge and are rarely monitored closely. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Do I need to be on the internet side for this to matter?
The record describes UDP port 5353 multicast DNS. That traffic normally stays on a local network, so the main risk is a hostile host on the same segment.
Is this the same as CVE-2026-30872?
No. Both are in the mdns daemon but in different functions. Upgrading to 24.10.6 or 25.12.1 covers both.
Sources
- OpenWrt security advisory GHSA-7c3j-f7w2-p8f6
- OpenWrt v24.10.6 release
- OpenWrt v25.12.1 release
- NVD record for CVE-2026-30871
Last reviewed: 19 October 2026.
