CVE-2026-22213

LOW EPSS 28.1%
Published Jan 12, 20265mo ago · Modified Jun 17, 20262w ago
2.4 CVSS 4.0
Low
Find Similar
Published Jan 12, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.

CVSS Details

Base Score
2.4
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
28.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-121

Affected Products 3

VendorProductVersionRange
riot-osriot* <2025.10
riot-osriot2026.01any
riot-osriot2026.01any

References 4

  • github.com https://github.com/RIOT-OS/RIOT
    Product
  • seclists.org https://seclists.org/fulldisclosure/2026/Jan/15
    ExploitMailing ListThird Party Advisory
  • riot-os.org https://www.riot-os.org/
    Product
  • vulncheck.com https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-tapslip6-utility
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.