CVE-2026-22214: Riot-os Riot buffer overflow (CVSS 9.8)

Description

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Riot-os Riot< 2025.10 · 2026.01

Remediation

Fixed in

Riot-os Riot≥ 2025.10

References

https://github.com/RIOT-OS/RIOTProduct
https://seclists.org/fulldisclosure/2026/Jan/16Mailing ListThird Party Advisory
https://www.riot-os.org/Product
https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-ethos-serial-frame-parserThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-22214 being actively exploited?

CVE-2026-22214 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.46%.

How severe is CVE-2026-22214?

CVE-2026-22214 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.46% probability of exploitation.

Which products are affected by CVE-2026-22214?

Affected products include Riot-os Riot.

How do I fix CVE-2026-22214?

Upgrade affected software to a fixed version, for example Riot-os Riot 2025.10 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-22214 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo