CVE-2026-48715 radvd-project CVE debrief

Who should care

Defenders managing IPv6 networks using radvd should assess their exposure to this vulnerability. Specifically, those using radvd versions prior to 2.21 and relying on the radvdump utility are at risk. Given the high CVSS severity, prioritizing patching or mitigation is crucial to prevent potential exploitation.

Technical summary

The CVE-2026-48715 vulnerability is a stack buffer overflow in the Route Information option parser of radvdump, a utility shipped with radvd. When processing a crafted ICMPv6 Router Advertisement, the print_ff() function copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, resulting in a potential overflow of up to 2016 bytes. The main radvd daemon is not affected by this vulnerability. The issue was addressed in radvd version 2.21.

Defensive priority

High priority due to CVSS score of 7.7 and potential for exploitation

Recommended defensive actions

• Inventory radvd installations and assess exposure
• Review official advisories for CVE-2026-48715
• Apply patch or upgrade to radvd version 2.21 or later
• Monitor for suspicious ICMPv6 Router Advertisement activity
• Implement compensating controls to limit exposure

Evidence notes

The primary evidence for this vulnerability comes from the NVD and CVE.org records. The vulnerability affects radvd versions prior to 2.21. Defenders should verify their radvd versions and assess exposure. The main radvd daemon is not affected, but the radvdump utility is vulnerable.

Official resources