CVE-2026-22214: RIOT OS Stack-Based Buffer Overflow in ethos Serial Frame Parser
CVE-2026-22214 is a stack-based buffer overflow (CWE-121) in the ethos utility of RIOT OS, caused by missing bounds checks when incoming serial frame bytes are written to a fixed-size stack buffer. NVD scores it 9.8 (critical) under CVSS 3.1, while VulnCheck scores it 6.8 under CVSS 4.0. The record shows no KEV listing and no confirmed exploitation in the sources consulted.
Overview
The record describes a stack-based buffer overflow (CWE-121) in the ethos utility of RIOT OS. Incoming serial frame bytes are appended to a fixed-size stack buffer in the _handle_char() function without checking that the write index stays in bounds. The described result is memory corruption and an application crash.
Impact
- The description states that a write past the end of the stack buffer leads to memory corruption and application crash.
- NVD assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network-reachable, low-complexity, no-privilege, no-user-interaction conditions with high confidentiality, integrity and availability impact.
- VulnCheck assigns CVSS 4.0 base score 6.8.
- The SSVC data in the record lists technical impact as partial and automatable as no.
Affected products and versions
- RIOT OS: up to and including 2026.01-devel-317.
- Riot-os Riot entries in the record: before 2025.10, the development version 2026.01-devel, and the release candidate 2026.01-rc1.
- The record does not provide a fixed version.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by KEV. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as poc, which indicates that proof-of-concept activity is documented in the SSVC data, but this does not confirm attacks in the wild. EPSS probability is 0.00464 with percentile 0.39237.
Remediation and mitigation
- The record lists no fixed release. Check the upstream RIOT project repository and maintainer channels for a release or commit that addresses the ethos frame parser.
- Until a fix is confirmed, restrict who can reach the serial interface and any TCP ports that carry ethos-framed traffic, using network segmentation and access controls.
- Prioritize inventory of devices or builds running affected RIOT OS versions, especially development and release candidate builds.
Detection guidance
- Monitor for unexpected crashes or restarts of RIOT-based firmware, which the description identifies as a consequence of the overflow.
- Log and review abnormal volumes or malformed frames on serial and TCP links used by the ethos utility.
Limitations of the available information
- The record gives no fixed version and no vendor patch.
- The EPSS date in the record (2026-10-23) is later than the publication date (2026-01-12), so it should be verified against the source before relying on it.
- The record does not describe exploitability in detail beyond the description, and this analysis does not provide technical exploitation steps.
Frequently asked questions
What is CVE-2026-22214?
It is a stack-based buffer overflow (CWE-121) in the ethos utility of RIOT OS. Incoming serial frame bytes are written to a fixed-size stack buffer without bounds checking, which can corrupt memory and crash the application.
Which versions are affected?
According to the record, RIOT OS versions up to and including 2026.01-devel-317 are affected. Riot-os Riot entries list versions before 2025.10, the development version 2026.01-devel, and the release candidate 2026.01-rc1.
Is this vulnerability being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data shows a poc exploitation status, which is not the same as confirmed attacks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.