CVE-2026-89028: MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected?
MikroTik RouterOS versions before 7.24 are affected. The vulnerable component is the userspace SMB daemon.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction by sending a malformed SMB1 SessionSetupAndX request containing a crafted uniPwdLen value.
What is the practical impact of successful exploitation?
The malformed uniPwdLen value causes an integer underflow and an oversized memory copy into a smaller heap buffer, corrupting adjacent heap memory. The reported security impact is availability loss; no confidentiality or integrity impact is specified.
What version should be deployed to remediate the issue?
Upgrade RouterOS to version 7.24 or later.