CVE-2026-22214 is a critical stack based buffer overflow (CVSS 9.8) in the ethos utility of RIOT OS, in versions up to and including 2026.01-devel-317. Serial frame input can push a write index past a fixed buffer. The record names no fixed version, so update RIOT and read the advisory.
What's affected
RIOT OS versions up to and including 2026.01-devel-317, in the ethos utility, in the _handle_char() function.
The record does not name a fixed release. Use the VulnCheck advisory and the RIOT repository to find the current status.
How to check if you're exposed
ethos is a host side tool that bridges a serial link to a network interface for RIOT boards. Check whether your team runs it.
find /path/to/RIOT -name "ethos*"
ps aux | grep -i ethos
If it runs, note where its serial or TCP framed input comes from, and who can send data into it.
What to do now
- Update your RIOT checkout beyond 2026.01-devel-317 and read the advisory for fix status.
- Stop running ethos on shared or internet facing hosts until you have updated.
- Restrict who can send data into the serial or TCP path the tool listens on.
- Rebuild host tools after updating the source tree.
- Add RIOT to your dependency inventory so future advisories are matched.
Why it matters
The weakness is CWE-121, a stack based buffer overflow. The record says _handle_char() appends incoming frame bytes to a fixed size stack buffer without checking that the write index stays inside it. An attacker who can send crafted serial or TCP framed input can push the index past the end.
The record states the outcome as memory corruption and application crash. Both RIOT utilities in this pair were disclosed on the same day and share the same class of flaw. A missing bounds check on a counter that grows with input is simple to write and simple to review for.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list.
Quick check
How is this different from CVE-2026-22213?
It is the same class of flaw in a different tool. This one is in the ethos serial frame parser, and the other is in tapslip6.
Is there a fixed release?
The record names none. Read the VulnCheck advisory and the repository history.
Sources
Last reviewed: 19 October 2026.
