A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

A heap-based buffer overflow vulnerability has been identified in openNDS versions prior to 11.0.0, tracked as CVE-2026-38821. The flaw resides in the http_microhttpd.c source file and can be exploited by an unauthenticated attacker present on the captive portal network. Successful exploitation can cause the openNDS daemon to crash, resulting in a denial of service condition. Beyond DoS, the vulnerability potentially enables remote code execution on affected systems. No authentication is required to trigger the vulnerability, lowering the barrier for exploitation significantly. A fix has been committed to the openNDS GitHub repository, with the patch available at commit 3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9. Users are strongly advised to upgrade to openNDS 11.0.0 or later to remediate the risk. The vulnerability affects network infrastructure environments utilizing captive portal solutions.