CVE-2026-86510: An Out-of-Bounds Write in the D-Link DIR-822A L2TP Daemon

Vulnerability overview

CVE-2026-86510 is an out-of-bounds write in the L2TP control message parser of the D-Link
DIR-822A wireless router. It carries a CVSSv3 base score of 9.9 and was published alongside a
second, unrelated defect in the same firmware, CVE-2026-86296, which scores 10.0. Both were
disclosed together with working proof-of-concept code. As of this writing, no in-the-wild
exploitation has been confirmed.
The affected firmware version is A_101.

Mechanism and exploitation conditions

The flaw sits in the routine that configures tunnel parameters, identified in the disclosure as
tunnel_set_params. When the device processes an L2TP control message, it copies fields from the
incoming packet into a fixed structure without first checking that the source data fits. A packet
that supplies more data than the destination can hold overwrites adjacent memory.
The practical consequence is memory corruption in the daemon that handles L2TP. The disclosure
describes the trigger as malformed control packets sent by an attacker who already has network
access to the device. That access requirement matters: this is not a remote, internet-facing
pre-authentication bug in the way the companion DHCP flaw is often described. An attacker needs a
position on the local network, or another way to deliver L2TP control traffic to the daemon.
The disclosure does not publish a full register-level analysis of which bytes land where, and this
article does not invent one. What is established is the class of bug, the affected function, the
attacker's position, and the fact that public exploit code exists.

Impact

An out-of-bounds write in a network daemon gives an attacker two immediate options. The first is
denial of service: corrupting adjacent memory reliably crashes the process, and on a small embedded
device that can take the management plane offline. The second, and the reason this carries a 9.9, is
code execution. If the overwritten memory includes a return address or a function pointer, the
attacker can redirect control flow. Whether that is reachable in practice depends on the exact
build, the compiler's mitigations, and the layout of the affected structure — none of which the
public disclosure resolves.
For a router, either outcome is serious. The device sits at the boundary of a home or small-office
network, and control of it means control of the traffic that passes through it.

Affected products and scope

The reported affected product is the D-Link DIR-822A running firmware A_101. D-Link has stated that
it is reviewing the reported vulnerability, the affected product scope, and available remediation
options, which means the vendor has not yet confirmed whether other hardware revisions or older
releases share the defect. Treat the A_101 statement as the confirmed boundary and everything else
as open.

Exposure context

ZoomEye returned 624 assets for the model title query title="DIR-822" and 6,697,454 assets for the broader vendor fingerprint app="D-Link". The vendor-wide number says nothing about which firmware is installed, so the model-specific count is the figure worth quoting. Even that number only proves that DIR-822 family devices are reachable from the internet or a scanned network; it does not prove that any of them are exploitable.

Remediation and mitigations

There is no patched firmware for these issues at the time of writing. D-Link published a
preliminary notice rather than a fixed release, so the practical options are containment:

Isolate the router from untrusted network segments where possible.
Disable remote management on the WAN interface.
Restrict local network access to known devices, and keep guest networks away from the administration interface.
Watch D-Link's security publication page for a fixed build, and plan to replace the hardware if the vendor retires the model without a patch.