An out-of-bounds read vulnerability has been identified in MikroTik RouterOS, in the code that inspects TLS traffic for firewall rules that match TLS connections. A specially crafted packet could allow an attacker to crash the router or disclose a limited amount of memory contents. This issue was reported by Rasmus Moorats and is tracked as CVE-2026-52346.
The vulnerable code is only active on routers that have at least one firewall rule matching TLS connections (the tls-host feature), so devices that don’t use this feature are not affected. In most deployments the router’s firewall drops unsolicited traffic arriving from the internet, which prevents a maliciously crafted packet from reaching this code from the outside. A small number of configurations — such as port forwarding that exposes local services, or permissive firewall settings — could leave the router reachable from the internet. Even then, although the out-of-bounds read itself can be triggered from a distance, actually reading the leaked memory contents requires the ability to create firewall rules on the device, meaning an attacker would already need administrative access. In practice the risk for typical users is low, but upgrading is still strongly recommended.
This issue has been fixed. The fix is included in:
Users are advised to upgrade to one of these versions or any later release.
MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks.
Contact us about vulnerabilities