CVE-2026-62381
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched.
Risk Assessment
The risk includes the possibility of remote code execution or system crash by an attacker, which can lead to system integrity compromise and service availability issues.
Recommendation
It is recommended to upgrade LuCI to a version where the luci-lib-px5g package has been removed or patched, and to avoid using vulnerable branches.
Other vulnerabilities in LuCI
See all- CVE-2026-61876High
The vulnerability in LuCI is due to improper encoding of DHCPv6 lease hostnames before rendering in status tables. This allows adjacent network attackers to inject HTML markup by sending a DHCPv6 Client FQDN containing script tags.
- CVE-2021-27821Medium
The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.
Original NVD description (English source)
luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched.