D-Link has alerted users to a critical vulnerability tracked as CVE-2026-86296 affecting the DIR-822A dual-band router line. The flaw involves a stack-based buffer overflow paired with inadequate data validation in the device's DHCP server, and it requires neither authentication nor user interaction to trigger.
Attackers positioned on the same local network can craft malicious DHCP packets to overflow the buffer, potentially crashing the DHCP daemon or executing arbitrary code on affected routers. The vulnerability's severity is compounded by the fact that a security researcher has already released working proof-of-concept code, accelerating the likelihood of weaponization by threat actors.
In its advisory, D-Link explained the root cause: "A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. Successful exploitation may cause memory corruption and could allow an attacker to affect the device's confidentiality, integrity, or availability." The company further noted that "This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."
Compounding the threat, D-Link is also investigating a second critical flaw in the same router model. Designated CVE-2026-86510, this out-of-bounds write vulnerability resides in the L2TP control message parser and was reported by the same researcher. Attackers with basic-level privileges can manipulate input data to trigger arbitrary memory corruption on devices configured for L2TP or L2TPv6 WAN connectivity.
While D-Link continues its investigation and develops patches, the company has recommended that DIR-822A owners take immediate defensive steps: keep routers offline or behind network boundaries, disable remote management capabilities, and restrict administrative access to trusted systems and personnel through firewall rules and network access controls.
Although D-Link has not confirmed active exploitation of these two vulnerabilities, D-Link devices have a history of becoming targets for attackers seeking to compromise routers for botnet recruitment and distributed denial-of-service operations. The Cybersecurity and Infrastructure Security Agency tracks 26 D-Link vulnerabilities that have been exploited or remain under active exploitation, including two that ransomware operators have leveraged.