Quick answers
- Is CVE-2026-16095 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16095 being exploited in the wild.
- How severe is CVE-2026-16095?
- High severity, with a CVSS score of 8.8, published 18 July 2026.
- Which products and versions are affected?
- Shibby Tomato Shibby 1.28 RT-N5x MIPSR2 Build 124.
- Is there a fix for CVE-2026-16095?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-16095 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-16095?
- Check whether you run Shibby Tomato Shibby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based out-of-bounds write vulnerability exists in the setup_conntrack function (located at 0x41F708) within the /sbin/rc binary of Shibby Tomato firmware. The root cause is the use of an unchecked sprintf call that formats ten unsigned integers into a fixed 72-byte stack buffer. If the source values (read from procfs or NVRAM) are sufficiently large, the resulting string can reach approximately 92 bytes, overflowing the buffer by 20 bytes. This overflow can corrupt adjacent saved registers on the stack. While the primary impact is service instability or denial-of-service during boot or firewall configuration, it may potentially be leveraged for remote code execution by an authenticated user. The Shibby Tomato project is superseded by FreshTomato.
Affected products
- Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 1.28 RT-N5x MIPSR2 Build 124
Timeline
- 2026-06-10: disclosed: Initial researcher report on Gitee
- 2026-07-18: advisory: CVE published in NVD dataset