CVE-2026-22213

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.

• CWE-121

• https://github.com/RIOT-OS/RIOTProduct
• https://seclists.org/fulldisclosure/2026/Jan/15Exploit, Mailing List, Third Party Advisory
• https://www.riot-os.org/Product
• https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-tapslip6-utilityThird Party Advisory

Published

Jan 12, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22208OpenS100 (the reference implementation S-100 viewer) prior t…9.6
• CVE-2026-22209wpDiscuz before 7.6.47 contains a cross-site scripting vulne…5.5
• CVE-2026-2221A security flaw has been discovered in code-projects Online …9.8
• CVE-2026-22210wpDiscuz before 7.6.47 contains a cross-site scripting vulne…6.1
• CVE-2026-22211TinyOS versions up to and including 2.1.2 contain a global b…5.1
• CVE-2026-22212TinyOS versions up to and including 2.1.2 contain a stack-ba…4.8
• CVE-2026-22214RIOT OS versions up to and including 2026.01-devel-317 conta…9.8
• CVE-2026-22215wpDiscuz before 7.6.47 contains a cross-site request forgery…5.4
• CVE-2026-22216wpDiscuz before 7.6.47 contains a missing rate limiting vuln…5.3
• CVE-2026-22217OpenClaw version 2026.2.22 prior to 2026.2.23 contains an ar…6.1
• CVE-2026-22218Chainlit versions prior to 2.9.4 contain an arbitrary file r…6.5
• CVE-2026-22219Chainlit versions prior to 2.9.4 contain a server-side reque…7.7