Executive brief
A security vulnerability exists in radvdump, a diagnostic tool used to monitor IPv6 network traffic. An attacker on the same local network can send a specially crafted network packet that causes the tool to crash or potentially allows the attacker to take control of the system running the utility. This issue only affects the radvdump monitoring tool and does not impact the main radvd background service used for routing.
Technical details
A stack-based buffer overflow exists in the `print_ff()` function within `radvdump.c`. The vulnerability is caused by insufficient validation of the `nd_opt_ri_len` field in ICMPv6 Router Advertisement (RA) packets. While RFC 4191 specifies valid lengths of 1, 2, or 3, the code only checks if the length is greater than 1. An attacker can provide a value up to 255, causing `memcpy()` to write up to 2032 bytes into a 16-byte `struct in6_addr` on the stack. This can lead to corruption of the saved frame pointer and return address. Exploitation requires the attacker to be on the same Layer 2 network and for the victim to be actively running `radvdump`. The main `radvd` daemon is not affected as it does not parse this option. The issue is patched in version 2.21.
Affected products
- radvd-project radvdump < 2.21
Timeline
- 2026-05-25: advisory: GitHub Security Advisory published by maintainers
- 2026-06-19: disclosed: CVE published to NVD
- 2026-06-19: patched: Version 2.21 released with fix