CVE-2026-48715

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/radvd-project/radvd/commit/068bde13e3fd6a5fcdb6859e6a2acd293a325dc5	Patch
https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:radvd.litech:radvd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) radvd es un demonio de anuncio de router para IPv6. Antes de la versión 2.21, la utilidad ’radvdump’ que se distribuye con radvd contiene un desbordamiento de búfer de pila en el analizador de opciones de Información de Ruta. Al procesar un anuncio de router ICMPv6 manipulado, ’print_ff()’ copia hasta 2032 bytes de datos de paquete controlados por el atacante en una ’struct in6_addr’ de 16 bytes en la pila, desbordando hasta en 2016 bytes. Tenga en cuenta que el demonio principal ’radvd’ no se ve afectado por la vulnerabilidad. La versión 2.21 corrige el problema.

Information

Published : 2026-06-19 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-48715

Mitre link : CVE-2026-48715

CVE.ORG link : CVE-2026-48715

JSON object : View

Products Affected

radvd.litech

radvd

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-48715", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48715", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T13:57:31.322095Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "radvd-project", "product": "radvdump", "versions": [{"status": "affected", "version": "< 2.21"}]}]}], "published": "2026-06-19T20:16:17.663", "references": [{"url": "https://github.com/radvd-project/radvd/commit/068bde13e3fd6a5fcdb6859e6a2acd293a325dc5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue."}, {"lang": "es", "value": "radvd es un demonio de anuncio de router para IPv6. Antes de la versi\u00f3n 2.21, la utilidad \u2019radvdump\u2019 que se distribuye con radvd contiene un desbordamiento de b\u00fafer de pila en el analizador de opciones de Informaci\u00f3n de Ruta. Al procesar un anuncio de router ICMPv6 manipulado, \u2019print_ff()\u2019 copia hasta 2032 bytes de datos de paquete controlados por el atacante en una \u2019struct in6_addr\u2019 de 16 bytes en la pila, desbordando hasta en 2016 bytes. Tenga en cuenta que el demonio principal \u2019radvd\u2019 no se ve afectado por la vulnerabilidad. La versi\u00f3n 2.21 corrige el problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:radvd.litech:radvd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D504B756-E540-46F6-B1E0-BCB9683F0938", "versionEndExcluding": "2.21"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}