CVE-2026-48715: radvd Buffer Overflow Vulnerability

CVE-2026-48715 Overview

CVE-2026-48715 is a stack buffer overflow in the radvdump utility shipped with radvd, the router advertisement daemon for IPv6. Versions prior to 2.21 contain a flaw in the Route Information option parser. When radvdump processes a crafted ICMPv6 Router Advertisement, the print_ff() function copies up to 2032 bytes of attacker-controlled packet data into a 16-byte struct in6_addr on the stack. The result is a stack overflow of up to 2016 bytes. The main radvd daemon is not affected. Version 2.21 patches the vulnerability.

Critical Impact
An adjacent-network attacker sending a crafted ICMPv6 Router Advertisement can overflow the stack of radvdump, potentially leading to arbitrary code execution in the context of the user running the utility.

Affected Products

radvd versions prior to 2.21 (radvdump utility only)
Linux and Unix-like systems running radvdump for IPv6 RA diagnostics
The main radvd daemon is explicitly not affected

Discovery Timeline

2026-06-19 - CVE-2026-48715 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48715

Vulnerability Analysis

The defect is a classic stack-based buffer overflow [CWE-121] in the diagnostic tool radvdump. The tool decodes ICMPv6 Router Advertisement (RA) messages received on the local link and prints their option fields. The Route Information option carries a variable-length prefix, and the parser print_ff() trusts the length field embedded in the packet rather than enforcing the 16-byte fixed size of the destination struct in6_addr.

This trust boundary failure allows up to 2032 bytes of attacker-supplied data to be written into a 16-byte local variable, corrupting saved frame pointers, return addresses, and adjacent stack canaries when present. Because radvdump parses raw link-local traffic, exploitation requires only adjacency to the target segment.

Root Cause

The Route Information option parser in radvdump derives its copy length from the on-wire option length field without bounding it against the size of the destination buffer. print_ff() then performs a copy of up to 2032 bytes into a stack-allocated struct in6_addr of 16 bytes, overflowing by as much as 2016 bytes.

Attack Vector

An attacker on the same IPv6 link sends a malformed ICMPv6 Router Advertisement containing a Route Information option with an oversized prefix payload. Any host running radvdump to inspect router advertisements parses the packet and triggers the overflow. No authentication or user interaction is required beyond the operator running the utility.

text

// Patch excerpt from radvdump.8.man hardening change
 .B radvdump
 .B "[ \-vhfe ]"
 .BI "[ \-d " debuglevel " ]"
+.BI "[ \-u " username " ]"

 .SH DESCRIPTION
 .B radvdump

Source: radvd commit 068bde13. The patch hardens radvdump and introduces a -u username flag so the tool can drop privileges, reducing the impact of any future parser flaws.

Detection Methods for CVE-2026-48715

Indicators of Compromise

Unexpected crashes or SIGSEGV terminations of the radvdump process on Linux/Unix hosts.
Anomalous ICMPv6 Router Advertisement packets containing Route Information options with prefix lengths exceeding 128 bits or option lengths inconsistent with RFC 4191.
Unfamiliar processes spawned by the user account that runs radvdump.

Detection Strategies

Inspect link-local ICMPv6 traffic for malformed Type 24 (Route Information) options where the option Length field implies a payload larger than the standard 8, 16, or 24 bytes.
Audit endpoints for installed radvd package versions less than 2.21 using package managers such as dpkg -l radvd or rpm -q radvd.
Correlate IPv6 RA flood events with process crashes through host telemetry.

Monitoring Recommendations

Enable Router Advertisement Guard (RA Guard) on managed switches to filter unauthorized RAs at the access layer.
Forward IPv6 NDP and ICMPv6 logs to a centralized log platform and alert on RA option length anomalies.
Monitor execution of radvdump in production environments where it should not normally run.

How to Mitigate CVE-2026-48715

Immediate Actions Required

Upgrade radvd to version 2.21 or later on every host where radvdump is installed.
Stop running radvdump interactively on untrusted network segments until the patch is applied.
Restrict execution of radvdump to administrators and avoid running it as root.

Patch Information

radvd version 2.21 fixes the bounds check in the Route Information option parser used by radvdump. See the GitHub Security Advisory GHSA-52px-gh9p-m379 and the upstream fix in radvd commit 068bde13. Distribution maintainers should backport the patch to supported branches.

Workarounds

Deploy RA Guard or equivalent ICMPv6 filtering on switches to drop rogue Router Advertisements.
Run radvdump under an unprivileged account using the new -u username flag once 2.21 is installed.
Use isolated capture hosts and tcpdump for RA diagnostics until the patched package is deployed.

bash

# Verify and upgrade radvd on Debian/Ubuntu
dpkg -l radvd | grep '^ii'
sudo apt-get update && sudo apt-get install --only-upgrade radvd
radvdump -v 2>&1 | head -n 1   # confirm version >= 2.21

# Run radvdump with reduced privileges (2.21+)
sudo radvdump -u nobody