CVE-2026-22214

CriticalPublic PoC

Published: 12 January 2026

Published

12 January 2026

Modified

21 January 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0007 20.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22214 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Riot-Os Riot. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Mandates validation of incoming serial or TCP frame data to ensure bounds are not exceeded, directly addressing the missing bounds checking in _handle_char() that causes the stack buffer overflow.

SI-16 Memory Protection good match

prevent

Implements runtime memory protections such as stack canaries or non-executable stacks to detect and prevent exploitation of stack-based buffer overflows leading to memory corruption.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and patching of flaws like the buffer overflow in RIOT OS ethos utility to remediate the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Stack buffer overflow in network-accessible serial/TCP frame parser enables remote unauthenticated exploitation of the service for memory corruption, RCE, or DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes…

are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.

Deeper analysisAI

CVE-2026-22214, published on 2026-01-12, is a stack-based buffer overflow vulnerability (CWE-121) in RIOT OS versions up to and including 2026.01-devel-317. The flaw affects the ethos utility during processing of incoming serial frame data in the _handle_char() function. There, incoming frame bytes are appended to a fixed-size stack buffer without bounds checking on the current write index, allowing it to exceed the buffer size and cause writes past the buffer end. This results in memory corruption and application crash. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attackers capable of sending crafted serial or TCP-framed input can exploit the vulnerability. The network-accessible attack vector, low complexity, lack of required privileges or user interaction, and unchanged scope enable remote exploitation by unauthenticated adversaries with access to the relevant serial interface or TCP endpoint. Exploitation triggers the buffer overflow, leading to memory corruption and application crash, with high potential impacts on confidentiality, integrity, and availability.

Mitigation details are available in related advisories, including the RIOT-OS GitHub repository at https://github.com/RIOT-OS/RIOT, SecLists Full Disclosure at https://seclists.org/fulldisclosure/2026/Jan/16, the RIOT-OS website at https://www.riot-os.org/, and the VulnCheck advisory at https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-ethos-serial-frame-parser.