CVE-2026-48715: radvdump Buffer Overflow in IPv6 Router Advertisement Parser

Technical summary

CVE-2026-48715 is a stack-based buffer overflow in radvdump's Route Information option parser. The vulnerability exists in the `print_ff()` function, which copies up to 2032 bytes from packet data into a 16-byte `struct in6_addr` without proper bounds checking, resulting in a 2016-byte overflow. The flaw is triggered when parsing ICMPv6 Router Advertisement messages with malicious Route Information options. The attack vector is network-adjacent (AV:A), requires no privileges or user interaction, and can compromise confidentiality, integrity, and availability. The core radvd daemon process is unaffected; only the radvdump utility is vulnerable.

Business impact

For organizations deploying IPv6 infrastructure with radvd, this vulnerability poses a localized but serious risk. Radvdump is typically used for network diagnostics, packet capture analysis, and troubleshooting—often run with elevated privileges by network administrators. Compromise of this utility could allow an attacker on the same link-local network to gain code execution in the context of the user running radvdump, potentially leading to lateral movement, data theft, or network manipulation. The attack requires network adjacency, limiting exposure to environments where attackers can reach the local network segment.

Affected systems

radvd versions prior to 2.21 are affected. The vulnerability is specific to the radvdump utility; the production radvd daemon itself remains unaffected. Any IPv6 network relying on radvd for router advertisement should evaluate whether radvdump is in use for operational or diagnostic purposes, particularly in sensitive network environments.

Exploitability

Exploitation requires the attacker to be on the same local network as the target system and to craft a malicious ICMPv6 Router Advertisement packet. The attack does not require authentication, user interaction, or a specific system configuration—making it straightforward to execute for anyone positioned on the network segment. The CVSS score of 8.8 (HIGH) reflects the high impact potential (code execution) combined with low attack complexity and no authentication barrier. However, the attack is network-adjacent only, not remotely exploitable over the Internet.

Remediation

Upgrade radvd to version 2.21 or later. This patch version introduces proper bounds checking in the `print_ff()` function to prevent oversized copies. For deployments unable to patch immediately, network segmentation and access controls limiting which systems can send or receive ICMPv6 Router Advertisements can reduce exposure. Additionally, restrict execution of radvdump to trusted users and network administrators only.

Patch guidance

Verify that radvd has been updated to version 2.21 or later by checking the installed version using `radvd -v` or consulting your package manager. Test the patched version in a non-production environment before full deployment to ensure compatibility with existing router advertisement configurations. Consult the radvd project release notes and the vendor advisory for any additional configuration or compatibility notes.

Detection guidance

Monitor for unexpected execution of radvdump, particularly from non-administrative users or unusual contexts. Log and alert on ICMPv6 Router Advertisement packets with unusually large or malformed Route Information options arriving on monitored network segments. Network intrusion detection systems should be configured to flag crafted ICMPv6 RA packets with oversized payloads. For systems running radvdump, enable application-level logging to capture parsing errors or crashes that may indicate exploitation attempts.

Why prioritize this

Although the CVSS score is HIGH (8.8), the actual organizational risk depends on radvdump's role in your environment. If radvdump is used actively for diagnostics or packet analysis on networks exposed to untrusted or semi-trusted nodes, this should be prioritized for immediate patching. If radvd is deployed only in controlled, highly segmented networks where local network access is tightly restricted, the urgency is lower but patching should still occur within normal update cycles. The lack of KEV (Known Exploited Vulnerability) status suggests no active, widespread exploitation in the wild at this time.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a high-impact vulnerability with broad consequences: the overflow can result in arbitrary code execution (integrity and availability impact) and potential information disclosure (confidentiality impact). The attack vector is network-adjacent (AV:A), meaning the attacker must be on the same link or able to send packets to the target's network segment—this restricts the threat model but does not eliminate it for organizations with permeable network boundaries or multi-tenant environments. The lack of required privileges (PR:N) and user interaction (UI:N) maximizes the threat surface among locally positioned adversaries. The severity assessment is appropriate for a network-adjacent code execution vulnerability affecting a diagnostic tool commonly run by administrators.

Frequently asked questions