RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility Severity Low Date January 12, 2026 Affecting RIOT OS <= 2026.01-devel-317 Vulnerability Details CVE: CVE-2026-22213 CWE: CWE-121 Stack-based Buffer Overflow CVSS: 4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Description RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption. References Researcher SecLists Disclosure RIOT OS Webpage RIOT OS GitHub Repository Credit Ron Edgerson