Vulnerability Description
radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Radvd.Litech | Radvd | < 2.21 |
Related Weaknesses (CWE)
References
- https://github.com/radvd-project/radvd/commit/068bde13e3fd6a5fcdb6859e6a2acd293aPatch
- https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379Vendor Advisory
FAQ
What is CVE-2026-48715?
CVE-2026-48715 is a vulnerability with a CVSS score of 8.8 (HIGH). radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processi...
How severe is CVE-2026-48715?
CVE-2026-48715 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48715?
Check the references section above for vendor advisories and patch information. Affected products include: Radvd.Litech Radvd.