CVE-2026-107837: CWE-125: Out-of-bounds Read in RIOT-OS RIOT

In RIOT-OS version 2026.07 and earlier, the _receive() function in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c inadequately validates packet size before processing 6LoWPAN fragments. This allows a remote attacker to send a malformed fragment that triggers gnrc_sixlowpan_frag_recv() to perform an out-of-bounds read on the packet buffer. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and can lead to partial memory disclosure and denial of service by crashing the network stack. No patched version or official fix has been released yet.

A remote attacker can exploit this vulnerability by sending a specially crafted 6LoWPAN fragment packet to a vulnerable RIOT-OS device. Successful exploitation may disclose memory contents beyond the intended buffer and cause the network stack to crash, resulting in denial of service. The CVSS v3.1 base score is 8.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, partial confidentiality impact, no integrity impact, and high availability impact.

As of the latest information, no official patch or fixed release is available for this vulnerability. Users should monitor the vendor's advisories for updates and apply patches once released. In the meantime, consider network-level filtering to block malformed 6LoWPAN fragments if feasible. Avoid exposure of vulnerable devices to untrusted networks to reduce attack surface.