Home › OpenWrt › 25.12.5

OpenWrt 25.12.5 – safe to update?

Newer release in this line: OpenWrt 25.12.6 (2026-10-18). If you're updating now, check that one instead — it may already fix the issues reported here.

Security update: this release fixes security issues (highest CVSS 9.6). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.

What's in this release

CVEs fixed

• CVE-2026-62948 CRITICAL 9.6 (NVD: fixed in this version)
  OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping,…
• CVE-2026-34182 CRITICAL 9.1 (named in release notes)
  Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of…
• CVE-2026-45447 HIGH 8.8 (named in release notes)
  Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. Wh…
• CVE-2026-40200 HIGH 8.1 (named in release notes)
  An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd…
• CVE-2026-7383 HIGH 8.1 (named in release notes)
  Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execut…
• CVE-2026-43500 HIGH 7.8 (named in release notes)
  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb t…
• CVE-2026-34180 HIGH 7.5 (named in release notes)
  Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash th…
• CVE-2026-34183 HIGH 7.5 (named in release notes)
  Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termi…
• CVE-2026-35385 HIGH 7.5 (named in release notes)
  In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
• CVE-2026-42764 HIGH 7.5 (named in release notes)
  Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the aff…
• CVE-2026-45445 HIGH 7.5 (named in release notes)
  Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the sa…
• CVE-2026-9076 HIGH 7.5 (named in release notes)
  Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read…
• CVE-2026-34181 HIGH 7.4 (named in release notes)
  Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker i…
• CVE-2026-53922 MEDIUM 6.5 (named in release notes)
  odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RE…
• CVE-2026-55490 MEDIUM 6.5 (named in release notes)
  OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UD…
• CVE-2019-6111 MEDIUM 5.9 (named in release notes)
  An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only di…
• CVE-2026-42766 MEDIUM 5.9 (named in release notes)
  Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInf…
• CVE-2026-42767 MEDIUM 5.9 (named in release notes)
  Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An…
• CVE-2026-42769 MEDIUM 5.3 (named in release notes)
  Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from…
• CVE-2026-62947 MEDIUM 4.9 (NVD: fixed in this version)
  OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FN…
• CVE-2026-45446 MEDIUM 4.8 (named in release notes)
  Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty…
• CVE-2026-6042 MEDIUM 4.8 (named in release notes)
  A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be in…
• CVE-2026-42768 LOW 3.7 (named in release notes)
  Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-st…
• CVE-2026-42770 LOW 3.7 (named in release notes)
  Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a f…
• CVE-2026-53918 (named in release notes)
  Not yet published in NVD.
• CVE-2026-53920 (named in release notes)
  Not yet published in NVD.
• CVE-2026-53921 (named in release notes)
  Not yet published in NVD.
• CVE-2026-55606 (named in release notes)
  Not yet published in NVD.
• CVE-2026-55612 (named in release notes)
  Not yet published in NVD.
• CVE-2026-55613 (named in release notes)
  Not yet published in NVD.
• CVE-2026-55614 (named in release notes)
  Not yet published in NVD.

Community reports

• Problem Google Streamer NFL app stuck loading after enabling AdBlock + Unbound on OpenWrt 25.12.5 · Reddit · 2026-10-03

  Environment: OpenWrt 25.12.5 Official OpenWrt luci-app-adblock Unbound Google TV Streamer After enabling Adblock and Unbound, the NFL app on my Google TV Streamer stopped loading. It would sit indefinitely on the spinning NFL logo. Suspending Adblock allowed the app to launch no…

• Mention A single MAC has multiple IPs on openWRT GL-MT6000 · Reddit · 2026-10-17

  Looking for some help trying to diagnose a network issue. I think the problem is stemming from openWRT but not sure. I have multiple IPs showing the same 22:2f:d0:ae:02:57 MAC when looking at the ARP table on my pfSense box. The MAC address indicate a locally administered or ran…

• Mention Flashing a RT-N66U · Reddit · 2026-10-12

  Tried flashing an old RT-N66U to tomato and OpenWrt, tomato failed but OpenWrt somewhat worked Background: It was running ASUS stock 3.0.0.4.382_52747 just fine. I factory reset it and tried to move it to FreshTomato 2026.4 (K26RT-AC AIO-64K) from the stock web UI. The flash wen…

• Mention WIFI consistently reboots? · Reddit · 2026-10-08

  Rebooted my OpenWrt One router after 20 days of flawless performance. Running OpenWrt 25.12.5 on an Apple Mac Mini. After the reboot my WIFI network would disconnect for a minute then reconnect. This would happen 3 or 4 times then settle down and run properly. I have both radio’…

• Mention Samsung A41 and Cudy WR3000S issues · Reddit · 2026-10-07

  I have a problem with my Samsung A41 connecting at 5GHz to a Cudy WR3000S running OpenWrt 25.12.5, the link seems to be continually degraded to 6Mb/s and I get really erratic wifi speeds. The A41 works fine with a BT Smarthub 2, and also a USB wifi dongle seems to be fine too. D…

• Mention Is a Linksys EA8500 a decent device to start tinkering? · Reddit · 2026-10-02

  Used device already flashed with 25.12.5 for a few bucks No particular use in mind, just want to get familiar with openwrt. Opinions?

• Mention GL.iNet - GL-MT6000 (Flint 2): "NETDEV WATCHDOG: CPU: 0: transmit queue 3 timed out" · Reddit · 2026-09-19

  Hi all, I am currently running OpenWrt on an GL.iNet - GL-MT6000 (Flint 2), with the following /etc/os-release details: bash NAME="OpenWrt" VERSION="25.12.5" ID="openwrt" ID_LIKE="lede openwrt" PRETTY_NAME="OpenWrt 25.12.5" VERSION_ID="25.12.5" HOME_URL="https://openwrt.org/" BU…

• Mention VLAN setup help · Reddit · 2026-09-17

  I've been fighting with this off and on for over a month. I am trying to setup 4 VLANs - 11 - Primary, 12 - Media/Streaming, 13 - IoT, 14 - Guest (wireless only) - Subnets are supposed to be 192.168.xx.0/24 where xx is the VLAN ID. I have two devices running OpenWRT - a Linksys…

• Mention Does MT7922 (RZ616) support IBSS/mesh point mode on Linux? · Reddit · 2026-09-12

  Building an open-source wireless mesh network (batman-adv) for multi-hop robot teleoperation need radios that support ad-hoc/IBSS or 802.11s mesh point mode in openwrt 25.12.5 System: OS: openwrt , SBC : Raspberry Pi 5, with pcie to m.2 hat. Trying to figure out if the newer MT7…

• Mention Setting WAN interface priority · Reddit · 2026-09-11

  Okay, I've been all over the place but theres no definitive answer I can find, so I'm turning here as a last resort. Xe3000 running 25.12.5 I have both the 5G modem, and the eth0 port plugged into hardwire WAN Both work fine if I disable the other. But I want to use the eth0 pri…

• Mention NanoPi R5S install question · Reddit · 2026-09-08

  Hello! I am looking to installing OpenWRT on a NanoPi R5S and the firmware selector subdomain only shows me sysupgrade images. The wiki also links to these and mentions no first time install images. Are these fine for downloading to a new board or is there an image for first tim…

Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.

← OpenWrt 25.12.4 · OpenWrt 25.12.6 →

Other OpenWrt versions

• 25.12.6 2026-10-18
• 24.10.8 2026-07-26
• 25.12.5 2026-07-01
• 24.10.7 2026-05-31
• 25.12.4 2026-05-14
• 25.12.3 2026-05-07
• 25.12.2 2026-03-27
• 25.12.1 2026-03-18