{"id":"CVE-2026-48715","aliases":["ALPINE-CVE-2026-48715","AZL-91275","CLSA-2026-1783420753","CLSA-2026-1783421652","CLSA-2026-1785838548","CLSA-2026-1792441621","CLSA-2026-1792441848","DEBIAN-CVE-2026-48715","EUVD-2026-38070","GHSA-52px-gh9p-m379","OESA-2026-2807","OESA-2026-2808","OESA-2026-2809","OESA-2026-2810","SUSE-SU-2026:22836-1","SUSE-SU-2026:3055-1","UBUNTU-CVE-2026-48715","openSUSE-SU-2026:11161-1","openSUSE-SU-2026:21400-1"],"status":"published","title":"radvdump's Route Information Option Parser has a Stack Buffer Overflow","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00333,"percentile":0.26877,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-06-19T19:18:23Z","modified":"2026-10-28T10:51:52Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"radvd","fixed_in":["2.21-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"radvd","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"radvd","fixed_in":["2.19-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"radvd","fixed_in":["2.19-5.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"radvd","fixed_in":["2.17-3.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"radvd","fixed_in":["2.17-3.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"radvd","fixed_in":["2.17-3.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"radvd","fixed_in":["2.18-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"radvd","fixed_in":["2.19-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"radvd","fixed_in":["2.19-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"radvd","fixed_in":["2.19-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"radvd","fixed_in":["2.21-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"radvd","fixed_in":["2.21-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"radvd","fixed_in":["2.17-150000.5.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"radvd","fixed_in":["2.21-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"radvd","fixed_in":["2.21-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-5.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-3.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-3.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-3.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.19-1","1:2.19-2","1:2.19-2.1","1:2.20-1","1:2.20-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.20-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150000.5.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.9.1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.11-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.16-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.17-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.18-3build1","1:2.18-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.19-1","1:2.19-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.20-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.20-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.20-1","1:2.20-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"radvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-160000.1.1"}]}]}],"products":[{"vendor":"radvd-project","product":"radvdump"},{"vendor":"radvd.litech","product":"radvd"}],"references":[{"url":"https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/radvd-project/radvd/commit/068bde13e3fd6a5fcdb6859e6a2acd293a325dc5","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-48715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48715","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783420753.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783421652.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1785838548.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792441621.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792441848.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48715.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48715","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2807","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2808","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2809","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2810","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622836-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268641","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48715","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263055-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-48715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48715","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-48715","title":"radvdump's Route Information Option Parser has a Stack Buffer Overflow","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T19:18:23.721Z","modified":"2026-06-22T13:57:45.067Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-38070","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T19:18:23Z","modified":"2026-06-22T13:57:45Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:35.26548Z"}],"nvd":[{"id":"CVE-2026-48715","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T20:16:17.663Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-48715","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T20:16:17.663Z","modified":"2026-10-01T02:17:49.321804603Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-48715","title":"radvdump's Route Information Option Parser has a Stack Buffer Overflow","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T19:18:23.721Z","modified":"2026-10-28T10:51:52.47230124Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"DEBIAN-CVE-2026-48715","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T20:16:17.663Z","modified":"2026-10-26T11:47:31.459238141Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"OESA-2026-2807","title":"radvd security update","description":"The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.\r\n\r\nSecurity Fix(es):\n\nradvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)","status":"published","published":"2026-07-06T11:11:43Z","modified":"2026-08-18T01:21:12.157283188Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2808","title":"radvd security update","description":"The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.\r\n\r\nSecurity Fix(es):\n\nradvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)","status":"published","published":"2026-07-06T11:11:43Z","modified":"2026-08-18T01:21:12.162249354Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2809","title":"radvd security update","description":"The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.\r\n\r\nSecurity Fix(es):\n\nradvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)","status":"published","published":"2026-07-06T11:11:43Z","modified":"2026-08-18T01:21:12.195007317Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2810","title":"radvd security update","description":"The router advertisement daemon (radvd) is run by Linux or BSD systems acting as IPv6 routers. It sends Router Advertisement messages, specified by RFC 2461, to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message. These messages are required for IPv6 stateless autoconfiguration.\r\n\r\nSecurity Fix(es):\n\nradvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.(CVE-2026-48715)","status":"published","published":"2026-07-06T11:11:43Z","modified":"2026-08-18T01:21:12.428346594Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-48715","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T20:16:00Z","modified":"2026-10-17T12:58:30.210629754Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-91275","title":"CVE-2026-48715 affecting package radvd for versions less than 2.21-1","description":"radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.","status":"published","published":"2026-06-19T20:16:17Z","modified":"2026-08-28T17:56:28.488652Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"CLSA-2026-1783420753","title":"radvd: Fix of CVE-2026-48715","description":"- CVE-2026-48715: fix stack buffer overflow in radvdump print_ff() Route\n  Information option parser via crafted ICMPv6 Router Advertisement","status":"published","published":"2026-07-07T10:39:30Z","modified":"2026-10-26T09:30:24.237689746Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783421652","title":"radvd: Fix of CVE-2026-48715","description":"- CVE-2026-48715: fix stack buffer overflow in radvdump print_ff() Route\n  Information option parser via crafted ICMPv6 Router Advertisement","status":"published","published":"2026-07-07T10:54:28Z","modified":"2026-10-26T09:31:12.275747547Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785838548","title":"radvd: Fix of CVE-2026-48715","description":"- CVE-2026-48715: radvdump stack buffer overflow in print_ff() Route\n  Information option parser via crafted ICMPv6 Router Advertisement","status":"published","published":"2026-08-06T14:52:57Z","modified":"2026-10-26T09:31:43.005130332Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1792441621","title":"radvd: Fix of CVE-2026-48715","description":"- CVE-2026-48715: radvdump stack buffer overflow in print_ff() Route\n  Information option parser via crafted ICMPv6 Router Advertisement","status":"published","published":"2026-10-19T20:27:11Z","modified":"2026-10-26T09:31:57.017876095Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792441848","title":"radvd: Fix of CVE-2026-48715","description":"- CVE-2026-48715: radvdump stack buffer overflow in print_ff() Route\n  Information option parser via crafted ICMPv6 Router Advertisement","status":"published","published":"2026-10-19T20:30:59Z","modified":"2026-10-26T09:31:59.52497711Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"openSUSE-SU-2026:11161-1","title":"radvd-2.21-1.1 on GA media","description":"These are all security issues fixed in the radvd-2.21-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-30T00:00:00Z","modified":"2026-07-01T09:45:10.393216227Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21400-1","title":"Security update for radvd","description":"This update for radvd fixes the following issue\n\n - CVE-2026-48715: crafted ICMPv6 Router Advertisement can lead to a stack-based buffer overflow (bsc#1268641).\n\nChanges for radvd:\n\n- Update to version 2.21.\n  * feat: RFC8319 support: Increase max AdvDefaultLifetime and MaxRtrAdvInterval.\n  * feat: Add DHCPv6-PD preferred flag.\n  * fix: improve file checks for procfs knobs.\n  * feat: allow libc strlcpy.\n  * fix: make libcheck fatal if missing with --with-check.\n  * refactor: make drop_root_privileges reusable.\n  * fix: support incoming jumbo packets.\n  * Avoid libbsd header with libc strlcpy.\n","status":"published","published":"2026-07-21T15:16:48Z","modified":"2026-07-24T18:24:25.249299441Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22836-1","title":"Security update for radvd","description":"This update for radvd fixes the following issue\n\n - CVE-2026-48715: crafted ICMPv6 Router Advertisement can lead to a stack-based buffer overflow (bsc#1268641).\n\nChanges for radvd:\n\n- Update to version 2.21.\n  * feat: RFC8319 support: Increase max AdvDefaultLifetime and MaxRtrAdvInterval.\n  * feat: Add DHCPv6-PD preferred flag.\n  * fix: improve file checks for procfs knobs.\n  * feat: allow libc strlcpy.\n  * fix: make libcheck fatal if missing with --with-check.\n  * refactor: make drop_root_privileges reusable.\n  * fix: support incoming jumbo packets.\n  * Avoid libbsd header with libc strlcpy.\n","status":"published","published":"2026-07-21T15:15:00Z","modified":"2026-07-28T18:24:09.252171037Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3055-1","title":"Security update for radvd","description":"This update for radvd fixes the following issue\n\n- CVE-2026-48715: stack-based buffer overflow in the `radvdump` Route Information option parser when processing crafted\n  ICMPv6 Router Advertisements (bsc#1268641).\n","status":"published","published":"2026-07-15T13:23:53Z","modified":"2026-07-16T10:00:14.920991496Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}