# CVE-2026-22214: RIOT OS stack overflow in ethos serial frame parser

Source: https://junglewise.ai/threats/cve-2026-22214-riot-os-stack-overflow-in-ethos-serial-frame-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-12. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-22214 · Severity: critical · CVSS 9.8 · Published 2026-01-12

RIOT OS, an operating system for Internet of Things (IoT) devices, contains a security flaw in its 'ethos' utility, which is used for serial communication. An attacker can send specially crafted data to a device to cause a system crash or potentially take control of the device. This could lead to service disruptions or unauthorized access to sensitive IoT infrastructure.

Technologies: [Riot-Os Riot](https://junglewise.ai/threats/technologies/riot). Vendors: [Riot-Os](https://junglewise.ai/threats/vendors/riot-os).

## Quick answers

**Is CVE-2026-22214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22214 being exploited in the wild.

**How severe is CVE-2026-22214?** Critical severity, with a CVSS score of 9.8, published 12 January 2026.

**Which products and versions are affected?** Riot-Os Riot up to and including 2026.01-devel-317.

**Is there a fix for CVE-2026-22214?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-22214 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-22214?** Check whether you run Riot-Os Riot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the RIOT OS 'ethos' utility within the _handle_char() function. The vulnerability is caused by a lack of bounds checking when appending incoming serial frame bytes to a fixed-size stack buffer (serial->frame). An attacker can exploit this by sending crafted serial or TCP-framed input that exceeds the Maximum Transmission Unit (MTU) size of 9000 bytes. This results in a write past the end of the buffer, leading to memory corruption, application crashes, and potentially arbitrary code execution. The flaw is reachable via network-based TCP-framed input if ethos is configured to listen for remote connections.

## Affected products

- RIOT-OS RIOT OS up to and including 2026.01-devel-317

## Timeline

- 2026-01-10: disclosed: Initial disclosure on Full Disclosure mailing list
- 2026-01-12: advisory: NVD and VulnCheck advisory published

## References

- [https://github.com/RIOT-OS/RIOT](https://github.com/RIOT-OS/RIOT)
- [https://seclists.org/fulldisclosure/2026/Jan/16](https://seclists.org/fulldisclosure/2026/Jan/16)
- [https://www.riot-os.org/](https://www.riot-os.org/)
- [https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-ethos-serial-frame-parser](https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-ethos-serial-frame-parser)

## Related threats

- [RIOT DHCPv6 client out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-49868-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap integer overflow in Block2 option parsing](https://junglewise.ai/threats/cve-2026-102692-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap_fileserver assertion failure in response handling](https://junglewise.ai/threats/cve-2026-107838-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT operating system out-of-bounds read in 6LoWPAN fragment handling](https://junglewise.ai/threats/cve-2026-107837-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanoCoAP client buffer underflow in blockwise transfer](https://junglewise.ai/threats/cve-2026-107836-riot-is-an-open-source-microcontroller-operating-system-designed)