CVE-2026-89020: MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.
Affected Software
Event History
Frequently Asked Questions
Which RouterOS releases are affected?
RouterOS releases before 7.23.4 on the long-term branch and before 7.24.2 on the stable branch are affected.
What access does an attacker need to trigger the crash?
An attacker needs authenticated RouterOS access with read-only group membership or higher. No elevated privileges beyond that membership are required.
Does exploitation require a TFTP server to be reachable?
No. The crafted tftp:// URL path triggers the overflow during request construction, so a reachable TFTP server is not required.
What is the practical impact of exploitation?
A user can crash the mtget worker process. The provided data describes availability impact only and does not indicate confidentiality or integrity impact.
What input indicates an attempted trigger?
The trigger is a /tool fetch command using a crafted tftp:// URL path of 507 bytes or more. The first write beyond the 528-byte buffer occurs at a path length of 505 bytes.