CVE-2026-22214

{"id": "CVE-2026-22214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22214", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T18:50:33.856751Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RIOT-OS/RIOT", "vendor": "RIOT", "product": "RIOT OS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.01-devel-317"}], "packageURL": "pkg:github/RIOT-OS/RIOT", "defaultStatus": "unknown"}]}], "published": "2026-01-12T23:15:52.453", "references": [{"url": "https://github.com/RIOT-OS/RIOT", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://seclists.org/fulldisclosure/2026/Jan/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.riot-os.org/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-ethos-serial-frame-parser", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash."}, {"lang": "es", "value": "Las versiones de RIOT OS hasta e incluyendo 2026.01-devel-317 contienen una vulnerabilidad de desbordamiento de b\u00fafer basado en pila en la utilidad ethos debido a la falta de verificaci\u00f3n de l\u00edmites al procesar datos de trama serie entrantes. La vulnerabilidad ocurre en la funci\u00f3n _handle_char(), donde los bytes de trama entrantes se a\u00f1aden a un b\u00fafer de pila de tama\u00f1o fijo sin verificar que el \u00edndice de escritura actual permanezca dentro de los l\u00edmites. Un atacante capaz de enviar entrada serie o enmarcada en TCP manipulada puede hacer que el \u00edndice de escritura actual exceda el tama\u00f1o del b\u00fafer, lo que resulta en una escritura m\u00e1s all\u00e1 del final del b\u00fafer de pila. Esta condici\u00f3n lleva a corrupci\u00f3n de memoria y a un fallo de la aplicaci\u00f3n."}], "lastModified": "2026-07-14T16:16:49.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EE45C18-0705-45D6-9363-63017333DFF1", "versionEndExcluding": "2025.10"}, {"criteria": "cpe:2.3:o:riot-os:riot:2026.01:devel:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51045419-7276-4017-8857-04DDBF865A1F"}, {"criteria": "cpe:2.3:o:riot-os:riot:2026.01:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D10D5F2C-4666-4D21-AED8-BE67DF223745"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}