AZL-91275

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91275.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-91275

Upstream

CVE-2026-48715

Published

2026-06-19T20:16:17Z

Modified

2026-08-28T17:48:06Z

Summary

CVE-2026-48715 affecting package radvd for versions less than 2.21-1

Details

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-48715

Affected packages

Azure Linux:3 / radvd

Package

Name: radvd
Purl: pkg:rpm/azure-linux/radvd

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.21-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91275.json"