CVE-2026-89020: Stack-based Buffer Overflow in MikroTik RouterOS
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.
AI Analysis
Technical Summary
CVE-2026-89020 is a stack-based buffer overflow vulnerability in MikroTik RouterOS affecting versions prior to 7.23.4 (long-term) and 7.24.2 (stable). The flaw resides in the mtget binary's TFTP RRQ builder function, where an authenticated user with read-only group membership can trigger a buffer overflow by issuing the /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow occurs because the first write outside the 528-byte buffer happens at 505 bytes, causing an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset. This results in the crash of the mtget worker process without requiring elevated privileges or a reachable TFTP server.
Potential Impact
The vulnerability allows authenticated users with read-only group membership to crash the mtget worker process, causing a denial of service condition on the affected MikroTik RouterOS device. There is no indication from the provided data that this vulnerability allows code execution or privilege escalation. The impact is limited to process crash and potential service disruption.
Mitigation Recommendations
A fix is available in MikroTik RouterOS versions 7.23.4 (long-term) and 7.24.2 (stable). Users should upgrade to these or later versions to remediate the vulnerability. Since the vendor advisory is not explicitly provided, patch status is inferred from the affected versions and known fixed versions. No additional mitigation steps are indicated.
CVE-2026-89020: Stack-based Buffer Overflow in MikroTik RouterOS
Description
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.
CVSS v4.0
Score 5.3medium
Affected software
MikroTik
RouterOS
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89020 is a stack-based buffer overflow vulnerability in MikroTik RouterOS affecting versions prior to 7.23.4 (long-term) and 7.24.2 (stable). The flaw resides in the mtget binary's TFTP RRQ builder function, where an authenticated user with read-only group membership can trigger a buffer overflow by issuing the /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow occurs because the first write outside the 528-byte buffer happens at 505 bytes, causing an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset. This results in the crash of the mtget worker process without requiring elevated privileges or a reachable TFTP server.
Potential Impact
The vulnerability allows authenticated users with read-only group membership to crash the mtget worker process, causing a denial of service condition on the affected MikroTik RouterOS device. There is no indication from the provided data that this vulnerability allows code execution or privilege escalation. The impact is limited to process crash and potential service disruption.
Mitigation Recommendations
A fix is available in MikroTik RouterOS versions 7.23.4 (long-term) and 7.24.2 (stable). Users should upgrade to these or later versions to remediate the vulnerability. Since the vendor advisory is not explicitly provided, patch status is inferred from the affected versions and known fixed versions. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-10T16:23:54.471Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa83dab55bf5e2cf57193de
Added to database: 09/14/2026, 18:32:11 UTC
Last enriched: 09/14/2026, 18:47:14 UTC
Last updated: 09/15/2026, 05:16:52 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.