Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-89020MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path

Medium 4.3

In plain English

A medium-severity stack buffer overflow in RouterOS from MikroTik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.

Affected products (as reported)

Vendor	Product	Versions
MikroTik	RouterOS	0 – before 7.23.47.24.0 – before 7.24.2

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

7.24.2 Release Notes patch, release-notes
7.23.4 Release Notes release-notes, patch
https://www.vulncheck.com/advisories/mikrotik-routeros-stack-buffer-overflow-via-tftp-url-path third-party-advisory