---
id: CVE-2026-89020
title: >-
  MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a
  stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ
  builder function that allows authenticated users to crash the mtget worker
  process by sup…
summary: >-
  MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a
  stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ
  builder function that allows authenticated users to crash the mtget worker
  process by sup…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-121
vendor: MikroTik
product: RouterOS
affected:
  - RouterOS < 7.23.4
  - RouterOS >= 7.24.0 < 7.24.2
published: '2026-09-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:44:42.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89020'
references:
  - url: 'https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801'
    label: disclosure@vulncheck.com
  - url: 'https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mikrotik-routeros-stack-buffer-overflow-via-tftp-url-path
    label: disclosure@vulncheck.com
  - url: 'https://mikrotik.com/supportsec/september-2026-vulnerability'
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00488
epssPercentile: 0.39385
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T16:07:48.174278Z'
ingestedAt: '2026-09-14T19:13:23.484Z'
---

## Overview

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.