Buffer overflow in Mikrotik Routeros
CVE-2026-89020
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.005 (41.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
Weakness classification (CWE)
References
- mikrotik.com/supportsec/september-2026-vulnerability (vendor-advisory, patch)
- www.vulncheck.com/advisories/mikrotik-routeros-stack-buffer-overflow-via-tftp-u… (third-party-advisory)
- forum.mikrotik.com/t/7-24-2-stable-is-released/272800 (release-notes, patch)
- forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 (release-notes, patch)
Frequently asked questions
- What is CVE-2026-89020?
- CVE-2026-89020 is a medium-severity vulnerability in Mikrotik Routeros, classified under Stack-based Buffer Overflow. CVSS score: 4.3/10. Published 2026-09-14.
- How severe is CVE-2026-89020?
- Medium severity. CVSS v3 base score is 4.3 out of 10.