CVE-2026-22213

Description

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.

PUBLISHED Reserved 2026-01-06 | Published 2026-01-12 | Updated 2026-01-13 | Assigner VulnCheck

Problem types

CWE-121 Stack-based Buffer Overflow

Product status

Credits

Ron Edgerson finder

References

seclists.org/fulldisclosure/2026/Jan/15 technical-description exploit

www.riot-os.org/ product

github.com/RIOT-OS/RIOT product

www.vulncheck.com/...sed-buffer-overflow-in-tapslip6-utility third-party-advisory

cve.org (CVE-2026-22213)

nvd.nist.gov (CVE-2026-22213)

Download JSON