Update: CVE-2026-22213 - RIOT OS <= 2026.01-devel-317 stack-based buffer overflow in tapslip6 utility

CVE ID : CVE-2026-22213 Published : Jan. 12, 2026, 11:15 p.m. | 1 hour, 35 minutes ago Description : RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption. Severity: 2.4 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor