CVE-2026-89020
Received Received - Intake

Stack-Based Buffer Overflow in MikroTik RouterOS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-89020
EUVD
EUVD-2026-77756

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mikrotik routeros to 7.23.4 (exc)
mikrotik routeros From 7.24.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in MikroTik RouterOS versions before 7.23.4 (long-term) and 7.24.2 (stable). It exists in the mtget binary's TFTP RRQ builder function. Authenticated users can crash the mtget worker process by providing a URL path of 507 bytes or more to the /tool fetch command. The overflow occurs due to an unbounded rep movsb instruction that overwrites saved registers at a fixed offset, crashing the process without needing a reachable TFTP server or elevated privileges beyond read-only group membership.

Detection Guidance

This vulnerability can be detected by checking the RouterOS version on MikroTik devices. If the version is below 7.23.4 (long-term) or 7.24.2 (stable), the system is vulnerable. Use the command /system package print to check the installed version.

Impact Analysis

This vulnerability allows authenticated attackers to crash the mtget worker process on MikroTik RouterOS devices. This can lead to denial-of-service conditions, disrupting network services and potentially causing temporary loss of device functionality. Since it requires only read-only group membership, it lowers the barrier for exploitation compared to requiring higher privileges.

Mitigation Strategies

Immediately update MikroTik RouterOS to version 7.23.4 (long-term) or 7.24.2 (stable) or later. Avoid using the /tool fetch command with TFTP URLs until the update is applied. Restrict access to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart