CVE-2026-89028— MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
Quick assessment
Affected
MikroTik RouterOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MikroTik RouterOS 在 7.24 之前的版本中存在一个堆内存损坏漏洞，该漏洞位于用户空间的 SMB 守护进程。该漏洞允许远程攻击者通过向 SMB1 SessionSetupAndX 处理器提供一个特制的 值，从而破坏相邻的堆内存。 具体机制如下：攻击者可以发送一个格式错误的 SMB1 请求，其中 字段会触发整数下溢（integer underflow）。下溢后的结果值随后被用作内存拷贝操作的拷贝长度，向一个更小的堆缓冲区进行数据拷贝，从而导致相邻堆内存被破坏。
Possible ATT&CK Techniques 1 AI
T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89028
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
Source: CVE Program / CVE List V5
Vulnerability Description
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89028
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89028
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89028 (1)
Vendor Pages for CVE-2026-89028 (1)
IV. Related Vulnerabilities
Same product: RouterOS
-
CVE-2026-56719
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 Session -
CVE-2026-89021
MikroTik RouterOS Path Traversal via Container OCI/tar Image -
CVE-2026-89020
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path -
CVE-2026-86060
SSH session privilege manipulation via a crafted username in -
CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik Router
Same vendor: MikroTik
-
CVE-2026-56719
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 Session -
CVE-2026-89021
MikroTik RouterOS Path Traversal via Container OCI/tar Image -
CVE-2026-89020
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path -
CVE-2026-86060
SSH session privilege manipulation via a crafted username in -
CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik Router
Same weakness: CWE-122
-
CVE-2026-91106
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vul -
CVE-2026-91105
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vul -
CVE-2026-91104
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vul -
CVE-2026-91098
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vul -
CVE-2026-92399
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-base
V. Comments for CVE-2026-89028
No comments yet