Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-89028MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX

High 7.5

In plain English

A high-severity heap buffer overflow in RouterOS from MikroTik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.

Affected products (as reported)

Vendor	Product	Versions
MikroTik	RouterOS	0 – through 6.49.187.0.0 – through 7.11.2

Weakness: CWE-122, CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Release Notes vendor-advisory, patch
https://www.vulncheck.com/advisories/mikrotik-routeros-heap-corruption-via-smb1-sessionsetupandx third-party-advisory