CVE-2026-39042

HIGH

MikroTik RouterOS 7.21.x < 7.21.4 and 7.22.x < 7.22.2 - Remote Denial of Service via libumsg.so unflatten() Function

Title source: llm

Description

An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.

References (2)

Core 2

Core References

https://mikrotik.com/supportsec

https://zakpatrik.cz/blog/finding-an-integer-overflow-in-mikrotik-routeros-core-ipc-library

Scores

CVSS v3 7.5

EPSS 0.0041

EPSS Percentile 33.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-190

Status published

Published Jul 13, 2026

Tracked Since Jul 14, 2026