CVE-2026-22213 RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility

What is CVE-2026-22213?

CVE-2026-22213 is a low-severity memory corruption vulnerability in RIOT OS, published on 12 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.

Weakness: CWE-121

Which versions are affected by CVE-2026-22213?

It affects 1 product.

Products include Riot-Os Riot.

How do I fix CVE-2026-22213?

No fix has been published for CVE-2026-22213 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-22213 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22213 exists.

Other vulnerabilities in RIOT OS

• CVE-2024-32017 Buffer overflows in RIOT Critical 9.8
• CVE-2023-33975 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add Critical 9.8
• CVE-2023-24819 RIOT-OS vulnerable to Buffer Overflow during IPHC receive Critical 9.8
• CVE-2023-24823 RIOT-OS vulnerable to Packet Type Confusion during IPHC send Critical 9.8
• CVE-2021-27357 Memory corruption in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xjvw-vc5c-qgj5.