CVE-2026-22214
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Stack-based buffer overflow in the ethos utility of RIOT OS up to version 2026.01-devel-317. Missing bounds checking in _handle_char() allows writing past the stack buffer when processing serial frames.
Risk Assessment
An attacker can crash the application remotely by sending crafted frame data, leading to denial of service.
Recommendation
Update RIOT OS to a version newer than 2026.01-devel-317 or apply the security patch immediately.
Other vulnerabilities in RIOT OS
See all- CVE-2026-22213Critical
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input.
- CVE-2025-66647Critical
In RIOT OS v2025.07, a vulnerability was discovered in the IPv6 fragmentation reassembly implementation. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to use to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.
Original NVD description (English source)
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.