CVE-2026-22213 is a critical stack based buffer overflow (CVSS 9.8) in the tapslip6 utility of RIOT OS, in versions up to and including 2026.01-devel-317. A long device name overflows a fixed buffer. The record gives no fixed version, so update to a current RIOT source tree and check the advisory.
What's affected
RIOT OS versions up to and including 2026.01-devel-317, in the tapslip6 utility.
The record does not name a fixed release. Pull the current RIOT source, compare the devopen() function against the repository history, and read the VulnCheck advisory for the latest status.
How to check if you're exposed
tapslip6 is a development tool that ships in the RIOT source tree, not a library you link into firmware. Check whether your build or lab setup uses it.
git -C /path/to/RIOT log -1 --format=%H
find /path/to/RIOT -name "tapslip6*"
Then check whether any script, container or CI job calls tapslip6, since that is where a long device name could come from.
What to do now
- Update your RIOT checkout to a revision newer than 2026.01-devel-317 and read the advisory for the fix status.
- Search your scripts, containers and CI jobs for calls to tapslip6.
- Do not pass untrusted or externally supplied values as the device name to the tool.
- If you vendor RIOT in your own repository, rebuild the host tools after updating.
- Record RIOT as a source dependency in your inventory so later advisories are matched.
Why it matters
The weakness is CWE-121, a stack based buffer overflow. The record says devopen() joins the fixed prefix /dev/ with a user supplied device name using strcpy() and strcat(), with no bounds check. A name longer than the buffer writes past it on the stack.
The record says the result is process crashes and memory corruption. The CVSS vector reads network, but the input described is a command line option of a local tool, so how reachable it is depends on how you run it. The record does not say it is exploited in the wild, and it is not on the CISA KEV list.
The fix pattern is the usual one: bound every copy, or use length checked string functions.
Quick check
Does this affect firmware running on devices?
The record places the flaw in the tapslip6 host utility. It does not describe it as part of the firmware image. Check how your team uses the tool.
Is there a fixed release?
The record names none. Read the VulnCheck advisory and the repository history.
Sources
Last reviewed: 19 October 2026.
