# [Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijack

Unchecked DHCP frame length in Switch ldn module's memmove overflows a stack buffer, letting a nearby Wi-Fi peer hijack control flow via ROP.

- Payout: not disclosed
- Severity: high
- Program: Nintendo
- Credited: moehw
- Disclosed: 2026-10-15
- CVE: CVE-2026-82079
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/3770768
- Library page: https://bugbountylibrary.com/r/h1%3A3770768
- Tags: domain:network impact:rce kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:memory-corruption vuln:rce

**Target:** ldn system module DHCP server over lp2p/LDN local wireless
**Root cause:** The ldn DHCP server reassembles frames with memmove(dst, src, total_size) into a fixed stack buffer without validating total_size, which is derived from attacker-controlled DHCP layer length.
**Steps:**
1. Host or join an lp2p/LDN local-wireless session so the console runs the ldn DHCP server.
2. From a Wi-Fi peer in range, send a single DHCP frame with an oversized DHCP-layer length field.
3. ldn parses layer lengths, sums them into total_size, and calls `memmove(dst, src, total_size)` into a fixed stack buffer.
4. Overflow overwrites saved return address and callee-saved registers.
5. Overwrite only the low 2 bytes of saved LR to redirect PC within a 64 KB window of the module, bypassing ASLR base knowledge.
6. Chain ROP gadgets to execute arbitrary code.
**How found:** Code review of the ldn module's frame reassembly path revealed memmove using a total_size summed from parsed layer lengths with no bounds check against the destination stack buffer; the DHCP-layer length being attacker-controlled made the overflow reachable from a single frame.
**Exploitation:** Attacker within wireless range sends one crafted oversized DHCP frame during an active LDN session; the unchecked memmove overflows the stack, and a partial LR overwrite redirects execution into a ROP chain for arbitrary code execution.
**Insight:** When a parser sums per-layer lengths into a copy size, check whether any single layer length is attacker-controlled and whether the sum is validated against the destination; partial overwrite of only the low 2 bytes of a saved LR can defeat ASLR when the target module's code window is known.