CVE-2026-30872 is a critical stack buffer overflow (CVSS 9.8) in the OpenWrt mdns daemon, in the function that matches IPv6 addresses, before versions 24.10.6 and 25.12.1. A specially crafted DNS query can trigger it. Upgrade to 24.10.6 or 25.12.1.
What's affected
OpenWrt versions before 24.10.6 and before 25.12.1 are affected. The fixed releases are 24.10.6 and 25.12.1.
The flaw is in match_ipv6_addresses and is reached through PTR queries for IPv6 reverse DNS domains under .ip6.arpa, received by multicast DNS on UDP port 5353.
How to check if you're exposed
Read the release on the device:
cat /etc/openwrt_release
Then see whether the mdns daemon is running:
ps | grep -i mdns
Any router on a release before 24.10.6 (24.10 line) or 25.12.1 (25.12 line) that runs the daemon and receives multicast DNS on UDP port 5353 should be treated as exposed.
What to do now
- Upgrade the device to OpenWrt 24.10.6 or 25.12.1 or later.
- Check the advisory for any interim mitigation, and keep untrusted hosts away from the multicast DNS port on the router.
- Segment guest and IoT networks from the network the router listens on.
- Ask vendors who ship OpenWrt based firmware when a fixed image will be available.
Why it matters
The weakness class is CWE-121, stack based buffer overflow. The domain name is copied with strcpy into a 256 byte stack buffer, and the reverse IPv6 request is then extracted into a buffer of only 46 bytes, the size of INET6_ADDRSTRLEN. The length is never checked before extraction, so longer input writes out of bounds.
The record says a crafted query could potentially enable remote code execution. It shares a daemon and a fix release with CVE-2026-30871, so one upgrade closes both. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why 46 bytes?
That is the size reserved for the text form of an IPv6 address. The code assumed the reverse name would always fit and never tested it.
Does the fix need a new package or a full image?
The advisory points to the 24.10.6 and 25.12.1 releases. Check the release notes for how your device receives the update.
Sources
- OpenWrt security advisory GHSA-mpgh-v658-jqv5
- OpenWrt v24.10.6 release
- OpenWrt v25.12.1 release
- NVD record for CVE-2026-30872
Last reviewed: 19 October 2026.
