Stack-Based Buffer Overflow in MikroTik RouterOS Affecting Authenticated Users

CVE-2026-89020

What is CVE-2026-89020?

MikroTik RouterOS versions before 7.23.4 (long-term) and 7.24.2 (stable) are susceptible to a stack-based buffer overflow within the mtget binary's TFTP RRQ builder function. This vulnerability allows authenticated users to cause the mtget worker process to crash by supplying a specially crafted URL path of 507 bytes or more through the /tool fetch command. This attack triggers a write outside the designated buffer, leading to process termination without requiring any special privileges beyond read-only access, enabling potential exploitation despite the absence of a reachable TFTP server.

References