CVE-2026-22213
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input.
Risk Assessment
An attacker can supply an excessively long device name via the -s option, causing a stack buffer overflow that leads to process crashes and memory corruption, potentially allowing arbitrary code execution.
Recommendation
Update RIOT OS to a version newer than 2026.01-devel-317 that includes the fix. Until then, avoid using the tapslip6 utility with untrusted input.
Other vulnerabilities in RIOT OS
See all- CVE-2026-22214Critical
Stack-based buffer overflow in the ethos utility of RIOT OS up to version 2026.01-devel-317. Missing bounds checking in _handle_char() allows writing past the stack buffer when processing serial frames.
- CVE-2025-66647Critical
In RIOT OS v2025.07, a vulnerability was discovered in the IPv6 fragmentation reassembly implementation. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to use to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.
Original NVD description (English source)
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.