Executive brief
MikroTik RouterOS includes a TFTP client utility used for file transfers and system operations. A stack buffer overflow in the mtget binary allows authenticated users with read-only access to crash the RouterOS process by sending a specially crafted fetch command with an oversized TFTP URL path. This can disrupt network operations on affected routers without requiring special privileges.
Technical details
The vulnerability is a stack-based buffer overflow in the mtget binary's TFTP RRQ (read request) builder function. The 528-byte stack buffer is overflowed when a URL path exceeds 507 bytes, causing an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset. An authenticated attacker with read-only group membership can trigger the overflow by issuing a /tool fetch command with a crafted tftp:// URL path; no reachable TFTP server or elevated privileges are required. The overflow crashes the mtget worker process but does not enable code execution. Patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
Affected products
- MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable)
Timeline
- 2026-09-14: disclosed
- 2026-09-03: patched: Patches released in RouterOS 7.23.4 (long-term) and 7.24.2 (stable)