# CVE-2026-89020: MikroTik RouterOS stack buffer overflow in TFTP client

Source: https://junglewise.ai/threats/cve-2026-89020-mikrotik-routeros-stack-buffer-overflow-in-tftp-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89020 · Severity: medium · CVSS 4.3 · Published 2026-09-14

MikroTik RouterOS includes a TFTP client utility used for file transfers and system operations. A stack buffer overflow in the mtget binary allows authenticated users with read-only access to crash the RouterOS process by sending a specially crafted fetch command with an oversized TFTP URL path. This can disrupt network operations on affected routers without requiring special privileges.

Technologies: [MikroTik RouterOS](https://junglewise.ai/threats/technologies/routeros). Vendors: [MikroTik](https://junglewise.ai/threats/vendors/mikrotik).

## Quick answers

**Is CVE-2026-89020 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89020 being exploited in the wild.

**How severe is CVE-2026-89020?** Medium severity, with a CVSS score of 4.3, published 14 September 2026.

**Which products and versions are affected?** MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable).

**Is there a fix for CVE-2026-89020?** A patch was published on 2026-09-03: Patches released in RouterOS 7.23.4 (long-term) and 7.24.2 (stable) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89020 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-89020?** Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack-based buffer overflow in the mtget binary's TFTP RRQ (read request) builder function. The 528-byte stack buffer is overflowed when a URL path exceeds 507 bytes, causing an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset. An authenticated attacker with read-only group membership can trigger the overflow by issuing a /tool fetch command with a crafted tftp:// URL path; no reachable TFTP server or elevated privileges are required. The overflow crashes the mtget worker process but does not enable code execution. Patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).

## Affected products

- MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable)

## Timeline

- 2026-09-14: disclosed
- 2026-09-03: patched: Patches released in RouterOS 7.23.4 (long-term) and 7.24.2 (stable)

## References

- [https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801](https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801)
- [https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800)

## Related threats

- [MikroTik RouterOS session token replay authentication bypass in WebFig](https://junglewise.ai/threats/cve-2026-89035-mikrotik-routeros-through-7-24-5-contains-a-session-token-replay)
- [MikroTik RouterOS integer overflow in ipt_SAME module](https://junglewise.ai/threats/cve-2026-112158-a-weakness-has-been-identified-in-mikrotik-routeros-up-to-6-40-5)
- [MikroTik RouterOS WinBox incorrect authorization in authentication](https://junglewise.ai/threats/cve-2026-103903-an-incorrect-authorization-vulnerability-in-the-winbox)
- [MikroTik RouterOS integer underflow](https://junglewise.ai/threats/cve-2026-84411-mikrotik-routeros)
- [MikroTik RouterOS improper input validation in BGP labelled-VPN NLRI](https://junglewise.ai/threats/cve-2026-93345-mikrotik-routeros-before-7-25beta4-contains-an-improper-input)