Every CVE Search/ Get API key

CVE-2026-48715

radvdump's Route Information Option Parser has a Stack Buffer Overflow

7.7 HighFix available

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.33%Up 0.2 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

radvdump's Route Information Option Parser has a Stack Buffer Overflow

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
CVE-2026-48715
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2026-38070 7.7

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
EUVD-2026-38070
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 7.7

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
CVE-2026-48715
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
OSVALPINE-CVE-2026-48715 8.8

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
ALPINE-CVE-2026-48715
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.7

radvdump's Route Information Option Parser has a Stack Buffer Overflow

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
CVE-2026-48715
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-121
Updated
2026-11-02
OSVDEBIAN-CVE-2026-48715 8.8

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
DEBIAN-CVE-2026-48715
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVOESA-2026-2807 7.7

radvd security update

The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.

Security Fix(es):

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)

Record
OESA-2026-2807
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2808 7.7

radvd security update

The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.

Security Fix(es):

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)

Record
OESA-2026-2808
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2809 7.7

radvd security update

The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.

Security Fix(es):

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)

Record
OESA-2026-2809
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2810 7.7

radvd security update

The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.

Security Fix(es):

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)

Record
OESA-2026-2810
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-48715 7.7

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
UBUNTU-CVE-2026-48715
CVSS 4.0
7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-91275 No score

CVE-2026-48715 affecting package radvd for versions less than 2.21-1

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

Record
AZL-91275
Updated
2026-11-02
OSVCLSA-2026-1783420753 No score

radvd: Fix of CVE-2026-48715

  • CVE-2026-48715: fix stack buffer overflow in radvdump print_ff() Route Information option parser via crafted ICMPv6 Router Advertisement
Record
CLSA-2026-1783420753
Updated
2026-11-02
OSVCLSA-2026-1783421652 No score

radvd: Fix of CVE-2026-48715

  • CVE-2026-48715: fix stack buffer overflow in radvdump print_ff() Route Information option parser via crafted ICMPv6 Router Advertisement
Record
CLSA-2026-1783421652
Updated
2026-11-02
OSVCLSA-2026-1785838548 No score

radvd: Fix of CVE-2026-48715

  • CVE-2026-48715: radvdump stack buffer overflow in print_ff() Route Information option parser via crafted ICMPv6 Router Advertisement
Record
CLSA-2026-1785838548
Updated
2026-11-02
OSVCLSA-2026-1792441621 No score

radvd: Fix of CVE-2026-48715

  • CVE-2026-48715: radvdump stack buffer overflow in print_ff() Route Information option parser via crafted ICMPv6 Router Advertisement
Record
CLSA-2026-1792441621
Updated
2026-11-02
OSVCLSA-2026-1792441848 No score

radvd: Fix of CVE-2026-48715

  • CVE-2026-48715: radvdump stack buffer overflow in print_ff() Route Information option parser via crafted ICMPv6 Router Advertisement
Record
CLSA-2026-1792441848
Updated
2026-11-02
OSVopenSUSE-SU-2026:11161-1 No score

radvd-2.21-1.1 on GA media

These are all security issues fixed in the radvd-2.21-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11161-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21400-1 No score

Security update for radvd

This update for radvd fixes the following issue

  • CVE-2026-48715: crafted ICMPv6 Router Advertisement can lead to a stack-based buffer overflow (bsc#1268641).

Changes for radvd:

  • Update to version 2.21.
    • feat: RFC8319 support: Increase max AdvDefaultLifetime and MaxRtrAdvInterval.
    • feat: Add DHCPv6-PD preferred flag.
    • fix: improve file checks for procfs knobs.
    • feat: allow libc strlcpy.
    • fix: make libcheck fatal if missing with --with-check.
    • refactor: make drop_root_privileges reusable.
    • fix: support incoming jumbo packets.
    • Avoid libbsd header with libc strlcpy.
Record
openSUSE-SU-2026:21400-1
Updated
2026-11-02
OSVSUSE-SU-2026:22836-1 No score

Security update for radvd

This update for radvd fixes the following issue

  • CVE-2026-48715: crafted ICMPv6 Router Advertisement can lead to a stack-based buffer overflow (bsc#1268641).

Changes for radvd:

  • Update to version 2.21.
    • feat: RFC8319 support: Increase max AdvDefaultLifetime and MaxRtrAdvInterval.
    • feat: Add DHCPv6-PD preferred flag.
    • fix: improve file checks for procfs knobs.
    • feat: allow libc strlcpy.
    • fix: make libcheck fatal if missing with --with-check.
    • refactor: make drop_root_privileges reusable.
    • fix: support incoming jumbo packets.
    • Avoid libbsd header with libc strlcpy.
Record
SUSE-SU-2026:22836-1
Updated
2026-11-02
OSVSUSE-SU-2026:3055-1 No score

Security update for radvd

This update for radvd fixes the following issue

  • CVE-2026-48715: stack-based buffer overflow in the radvdump Route Information option parser when processing crafted ICMPv6 Router Advertisements (bsc#1268641).
Record
SUSE-SU-2026:3055-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
radvd
Alpine:v3.24
 before 2.21-r0
2.21-r0
radvd
Azure Linux:3
 before 2.21-1
2.21-1
radvd
TuxCare:AlmaLinux:9.2
 before 2.19-5.el9_2.tuxcare.els1
2.19-5.el9_2.tuxcare.els1
radvd
TuxCare:AlmaLinux:9.6
 before 2.19-5.el9_6.tuxcare.els1
2.19-5.el9_6.tuxcare.els1
radvd
TuxCare:CentOS:7
 before 2.17-3.el7.tuxcare.els1
2.17-3.el7.tuxcare.els1
radvd
TuxCare:OracleLinux:7
 before 2.17-3.el7.tuxcare.els1
2.17-3.el7.tuxcare.els1
radvd
TuxCare:RHEL:7
 before 2.17-3.el7.tuxcare.els1
2.17-3.el7.tuxcare.els1
radvd
Debian:12
 All versions, plus listed versions
1:2.19-11:2.19-21:2.19-2.11:2.20-11:2.20-1~bpo12+1
 None known
radvd
Debian:13
 All versions, plus listed versions
1:2.20-1
 None known
radvd
Debian:14
 All versions, plus listed versions
1:2.20-1
 None known
Show 28 moreShow less
Affected packages
PackageAffectedFixed
radvd
openEuler:20.03-LTS-SP4
 before 2.18-7.oe2003sp4
2.18-7.oe2003sp4
radvd
openEuler:22.03-LTS-SP4
 before 2.19-5.oe2203sp4
2.19-5.oe2203sp4
radvd
openEuler:24.03-LTS-SP1
 before 2.19-4.oe2403sp1
2.19-4.oe2403sp1
radvd
openEuler:24.03-LTS-SP3
 before 2.19-4.oe2403sp3
2.19-4.oe2403sp3
radvd
SUSE:Linux Enterprise Server 16.0
 before 2.21-160000.1.1
2.21-160000.1.1
radvd
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.21-160000.1.1
2.21-160000.1.1
radvd
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 2.17-150000.5.8.1
2.17-150000.5.8.1
radvd
Ubuntu:14.04:LTS
 All versions, plus listed versions
1:1.9.1-1.1ubuntu2
 None known
radvd
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:2.11-1
 None known
radvd
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:2.16-3
 None known
radvd
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:2.17-2
 None known
radvd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:2.18-3build11:2.18-3build2
 None known
radvd
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:2.19-11:2.19-1ubuntu1
 None known
radvd
Ubuntu:25.10
 All versions, plus listed versions
1:2.20-1
 None known
radvd
Ubuntu:26.10
 All versions, plus listed versions
1:2.20-1build1
 None known
radvd
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:2.20-11:2.20-1build1
 None known
radvd
openSUSE:Tumbleweed
 before 2.21-1.1
2.21-1.1
radvd
openSUSE:Leap 16.0
 before 2.21-160000.1.1
2.21-160000.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-48715 is a high vulnerability (CVSS 7.7) in Radvd-project Radvdump, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in radvd 2.21-r0.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open