CVE-2026-22213: RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If tapslip6 is used, restrict access to the tapslip6 command-line interface so untrusted users cannot supply the -s device-name argument.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22213?
CVE-2026-22213 is classified as a high severity vulnerability due to the potential for remote code execution through a stack-based buffer overflow.
How do I fix CVE-2026-22213?
To fix CVE-2026-22213, upgrade RIOT OS to a version later than 2026.01-devel-317 to eliminate the buffer overflow in the tapslip6 utility.
What impact does CVE-2026-22213 have on systems?
CVE-2026-22213 can lead to unauthorized access and possible execution of malicious code on affected systems.
Which versions of RIOT OS are affected by CVE-2026-22213?
CVE-2026-22213 affects all versions of RIOT OS up to and including 2026.01-devel-317.
What causes CVE-2026-22213?
CVE-2026-22213 is caused by unsafe string concatenation in the devopen() function of the tapslip6 utility.