EUVD-2026-43601
GHSA-p5h9-77xr-72r8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed RouterOS network service
-
DeliverySend crafted IPC message
-
ExploitTrigger integer overflow in unflatten()
-
ExecutionCorrupt memory in libumsg.so
-
ImpactCrash IPC process, deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against RouterOS 7.21.x/7.22.x, requiring only the ability to send a crafted IPC message to a network-exposed RouterOS service that routes through the vulnerable unflatten() path in libumsg.so. Exploitation is LIMITED by the need to reach the affected service: devices whose management/IPC-backed services are firewalled to trusted networks or not exposed to the internet are not remotely reachable, and only the specified 7.21.x-before-7.21.4 and 7.22.x-before-7.22.2 builds are vulnerable. Impact is bounded to denial of service (A:H, C:N/I:N) - no code execution or data disclosure is indicated by the CVSS vector. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a cleanly remote, unauthenticated, low-complexity availability-only attack - no confidentiality or integrity impact. That maps to a pure denial of service, not code execution, despite the memory-safety root cause. Real-world exploitation signals are modest: EPSS is 0.20% (10th percentile), it is NOT listed in CISA KEV, and no working exploit is confirmed in the provided data. The presence of a detailed public technical write-up modestly raises the odds of a working DoS PoC emerging, but the absence of KEV/high-EPSS suggests this is currently a patch-on-normal-cycle issue rather than an emergency. Note a data gap: the CPE string provided is a placeholder ('cpe:2.3:a:n/a:n/a') and EUVD affected-version data reads 'n/a', so authoritative machine-readable version scoping is weak - the version ranges come from the CVE description text, which should be corroborated against MikroTik's advisory. |
| Exploit ScenarioDerived | An attacker who can reach an exposed RouterOS service over the network sends a crafted message whose length fields trigger the integer overflow inside unflatten() in libumsg.so, corrupting memory and crashing the IPC-handling process. With low attack complexity and no authentication or user interaction required, this can be repeated to keep the router or affected service offline. No working public exploit is identified at time of analysis, but a public research write-up detailing the overflow lowers the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Denial of service in MikroTik RouterOS 7.21.x (before 7.21.4) and 7.22.x (before 7.22.2) allows a remote unauthenticated attacker to crash the core inter-process communication layer by triggering an integer overflow in the unflatten() function of the bundled libumsg.so library. Successfully exploiting it disrupts device availability without touching data confidentiality or integrity. There is no public exploit identified at time of analysis, though a third-party research blog documents the underlying integer overflow; EPSS is low at 0.20% (10th percentile).
RemediationAI
Vendor-released patch: upgrade RouterOS 7.21.x devices to 7.21.4 or later and 7.22.x devices to 7.22.2 or later, which contain the fix for the unflatten() integer overflow; consult MikroTik's advisory at https://mikrotik.com/supportsec for exact channel details. Where immediate patching is not possible, reduce exposure by restricting network reachability of RouterOS management and service ports to trusted management networks or VPN (firewall the WAN-facing services, e.g. via /ip firewall rules and the 'Allowed From' service restrictions), since the attack is network-reachable and unauthenticated - the trade-off is that overly broad filtering can disrupt legitimate remote administration and dynamic routing/IPC peers. Disabling or firewalling any unneeded RouterOS services further shrinks the attack surface. Technical background on the flaw is documented at https://zakpatrik.cz/blog/finding-an-integer-overflow-in-mikrotik-routeros-core-ipc-library.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RouterOS is MikroTik's Linux-based network operating system running on the vendor's routers, switches, and CHR virtual instances. The flaw lives in libumsg.so, the shared library implementing RouterOS's internal message-passing/IPC used to serialize and reconstruct structured messages. The unflatten() routine deserializes ('unflattens') a message buffer, and a CWE-190 integer overflow in its length/size handling lets attacker-controlled input miscompute a value - leading to memory corruption or an out-of-bounds condition that crashes the handling process. Because this IPC library backs core RouterOS services reachable over the network, a malformed message can take down the affected process and, by extension, device functionality.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable IPC message with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.
Executive ViewAI
MikroTik RouterOS versions 7.21 through 7.22 contain a high-severity denial-of-service vulnerability enabling unauthenticated remote attackers to crash network devices, directly impacting organizational connectivity with no vendor patch currently available. This affects organizations that rely on these router models as critical network infrastructure, creating material risk of unscheduled downtime. While exploitation likelihood remains low at 0.2% (EPSS 10th percentile), the absence of available mitigation through patching requires immediate inventory and compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to affected devices via firewall rules limiting remote connectivity, segment devices from untrusted networks, enable logging and monitoring for abnormal device behavior or unexpected restarts, and maintain rapid deployment procedures for patched versions when released by MikroTik.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB