Full Changelog: v4.2.4...v4.2.5
The Extended Stable channel has been updated to 144.0.7559.236 for Windows and Mac which will roll out over the coming days/weeks.
The Stable channel has been updated to 145.0.7632.159/160 for Windows/Mac and 145.0.7632.159 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 10 security fixes. Please see the Chrome Security Page for more information.
[$33,000][485622239] Critical CVE-2026-3536: Integer overflow in ANGLE. Reported by cinzinga on 2026-02-18
[$32,000][474266014] Critical CVE-2026-3537: Object lifecycle issue in PowerVR. Reported by Zhihua Yao of KunLun Lab on 2026-01-08
[TBD][484983991] Critical CVE-2026-3538: Integer overflow in Skia. Reported by Symeon Paraschoudis on 2026-02-17
[TBD][483853098] High CVE-2026-3539: Object lifecycle issue in DevTools. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-02-12
[TBD][484088917] High CVE-2026-3540: Inappropriate implementation in WebAudio. Reported by Davi Antônio Cruz on 2026-02-14
[TBD][484811719] High CVE-2026-3541: Inappropriate implementation in CSS. Reported by Syn4pse on 2026-02-16
[TBD][485152421] High CVE-2026-3542: Inappropriate implementation in WebAssembly. Reported by qymag1c on 2026-02-17
[TBD][485267831] High CVE-2026-3543: Inappropriate implementation in V8. Reported by qymag1c on 2026-02-18
[TBD][485683110] High CVE-2026-3544: Heap buffer overflow in WebCodecs. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-19
[TBD][487383169] High CVE-2026-3545: Insufficient data validation in Navigation. Reported by Google on 2026-02-24
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Hi,
The OpenWrt community is proud to announce the first stable release of the OpenWrt 25.12 stable series.
Download firmware images using the OpenWrt Firmware Selector:
Download firmware images directly from our download servers:
OpenWrt 25.12.0 incorporates over 4700 commits since branching the previous OpenWrt 24.10 release and has been under development for over one year.
Only the main changes are listed below. See changelog-25.12.0 for the full changelog.
OpenWrt 25.12 is named Dave's Guitar to honor Dave Täht, who sadly passed away on April 1, 2025.
Dave played a key role in reducing bufferbloat and improving network latency in OpenWrt and across the wider internet. His work made networks faster, more responsive, and more reliable for millions of users.
This release is dedicated to his memory and lasting impact on the networking community.
The hardware requirements did not change significantly. Most devices supported by OpenWrt 24.10 are also supported in OpenWrt 25.12.
OpenWrt has transitioned from the traditional opkg package manager to apk (Alpine Package Keeper).
This change brings several advantages:
apk supports most features of opkg. Only very few package names changed. The command line arguments of apk are different from the command line arguments of opkg.
For users migrating existing systems, an official opkg to apk cheatsheet is available to ease the transition and map common workflows.
The attended sysupgrade LuCI application is now installed by default.
owut is included by default in images for devices with larger flash storage.
ASU allows devices to:
This dramatically simplifies upgrades: with just a few clicks in LuCI and a short wait, a custom firmware image is built and installed without manual intervention.
Shell command history is now preserved across sessions by storing it in a RAM-backed filesystem.
Benefits:
For users who prefer persistent history storage, this behavior can be changed by editing: ''/etc/profile.d/busybox-history-file.sh''
⚠️ Note: Storing history on flash will increase write cycles and may impact flash endurance over time.
The OpenWrt video feed with Qt5 and UI applications is integrated by default.
The Wi-Fi scripts were rewritten in ucode.
This is part of the rewrite of the management scripts from shell scripts to ucode.
uCode is used for system scripts because it is faster and safer than shell scripts, and integrates directly with ubus and UCI.
Wi-Fi and network management scripts rewritten in uCode run faster, have fewer errors, and are easier to maintain.
OpenWrt 25.12 supports over 2200 devices. Support for over 180 new devices was added in addition to the devices already supported in OpenWrt 24.10.
Most devices already supported by OpenWrt 24.10 are still supported.
Core components have the following versions in 25.12.0:
In addition to the listed applications, many others were also updated.
With the release of OpenWrt 25.12 stable series, the OpenWrt 24.10 stable series will go end of life in 6 months. We will not provide security updates for OpenWrt 24.10 after September 2026. We encourage everyone to upgrade to OpenWrt 25.12 before September 2026.
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
Sysupgrade from 23.05 to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed.
Bananapi BPI-R4: Interfaces ''eth1'' was renamed to ''sfp-lan'' or ''lan4'', and interface ''eth2'' was renamed to ''sfp-wan'' to match the labels. You have to upgrade without saving the configuration.
If you wish to start from scratch (always the safest, but also the most work), simply download the pre-built image from the downloads site or from the Firmware Selector to your device. Make sure to create and save a backup, then install the image using sysupgrade -n /tmp/firmware.bin or the LuCI Backup/Flash Firmware, being sure to set "Keep settings and retain the current configuration" to its off position. Restore or reconstruct your configuration using the contents of the backup as a template.
Attended Sysupgrade (ASU) allows you to build a custom image that retains all of your installed packages and their configuration transparently. You need to use one of the three ASU clients that interface with the ASU server to produce this custom image:
Both the LuCI ASU app and owut are optional packages in 24.10, so if you have not installed them, they won't be there by default. Use either the LuCI Package Manager to install them, or you can do it from the command line with opkg:
Log in
$ opkg update
$ opkg install luci-app-attendedsysupgrade
$ opkg install owut
Note that you can install one or the other, or both together, they are completely independent packages.
The Firmware Selector does an excellent job of searching through the thousands of available device configurations and getting you to the right place. But, some devices have several variants and possibly different image formats, so if you're unsure about which one you need or which device you're dealing with or anything else, go to the |Firmware Selector support thread and ask away.
The LuCI web interface is fairly self-explanatory. If anything is unclear, please refer to the LuCI Attended Sysupgrade support thread for guidance.
If you choose to use owut, the fact that it's a command line program means you'll need a little more explanation regarding best practices. In any situation, it's always safe to do a check to see what's going on.
$ owut check --verbose --version-to 25.12
... a lot of output ...
This check should show you all the details of what this upgrade entails with regards to the packages available, and will point out any issues with package versions and so on.
Assuming the results of the check look good, you can simply do an upgrade next.
$ owut upgrade --verbose --version-to 25.12
... even more output ...
If you are unsure of anything you see in the check, during the upgrade, or simply have questions, jump on over to the owut support thread on the forum and ask.
eth1 to wan.Full release notes and upgrade instructions are available at
https://openwrt.org/releases/25.12/notes-25.12.0
In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/25.12/notes-25.12.0#known_issues
For a detailed list of all changes since branching of 24.10, refer to
https://openwrt.org/releases/25.12/changelog-25.12.0
To download the 25.12.0 images, navigate to:
https://downloads.openwrt.org/releases/25.12.0/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org?version=25.12.0
As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.
Have fun!
The OpenWrt Community
To stay informed of new OpenWrt releases and security advisories, there
are new channels available:
a low-volume mailing list for important announcements:
https://lists.openwrt.org/mailman/listinfo/openwrt-announce
a dedicated "announcements" section in the forum:
https://forum.openwrt.org/c/announcements/14
other announcement channels (such as RSS feeds) might be added in the
future, they will be listed at https://openwrt.org/contact
