A stack-based buffer overflow in the RIOT OS tapslip6 utility arises from unsafe string concatenation in the devopen function. The function builds a device path by concatenating the constant prefix "/dev/" with a user-supplied device name passed via the –s command‑line option using strcpy() and strcat() without bounds checking. This flaw allows an attacker to supply a device name that exceeds the fixed‑size stack buffer, corrupting memory and causing the utility to crash. In the worst case, the memory corruption could be leveraged to execute arbitrary code with the privileges of the user running tapslip6.

The vulnerability affects RIOT OS versions up through and including 2026.01‑devel‑317. All builds that contain the tapslip6 utility in those releases are susceptible, because the unsafe construction of the device path is present in the source code for that utility. Only the devopen implementation in those versions is impacted; newer releases released after this date have the fix applied.

The CVSS score is 2.4, indicating low severity, and the EPSS score is below 1 %, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local access to run the tapslip6 binary and the ability to provide a long –s argument, so the risk is limited to systems where the utility is installed and usable. Because the flaw can lead to memory corruption, trusting only authorized users and applying safer string handling could contain the damage.