CVE-2026-86296

CriticalCVSS 10.0

Published: 07/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 07/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.35%

70th percentile - higher than 70% of all known CVEs

Summary

A vulnerability was found in D-Link DIR-822A A_101 in the strcpy function of the file udhcpcd/serverpacket.c in the udhcpcd component. This manipulation causes a stack-based buffer overflow. The attack can be carried out remotely and the exploit is publicly disclosed.

Risk Assessment

A remote attacker could exploit this buffer overflow to execute arbitrary code or crash the device, compromising network integrity and availability.

Recommendation

Immediately update the D-Link DIR-822A firmware to the latest available version if a patch is released. Also restrict external access to the device.

Other vulnerabilities in D-Link DIR-822A

CVE-2026-86510Critical
The D-Link DIR-822A router version A_101 has a vulnerability in the tunnel_set_params function of the L2TP Control Message Parser component, leading to an out-of-bounds write. The attack can be launched remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS