OpenSSL and D-Link disclose high-severity security vulnerabilities

OpenSSL has disclosed a high-severity vulnerability, tracked as CVE-2026-84782, affecting its Datagram Transport Layer Security (DTLS) implementation. The flaw involves an out-of-bounds read during DTLS handshake message retransmissions. This error can allow a remote peer to read unintended plaintext heap memory or cause a denial-of-service condition. The vulnerability affects multiple versions, including OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2.

Separately, a critical vulnerability (CVE-2026-86510) has been identified in the D-Link DIR-822A router. This out-of-bounds write in the L2TP control message parser has been assigned a severity score of 9.9. An attacker with network access could potentially corrupt memory in a privileged daemon, leading to service disruption or remote code execution. This issue affects devices running firmware A_101. While public proof-of-concept code exists, there has been no confirmed in-the-wild exploitation of this specific flaw.