CVE-2026-49868: CWE-125: Out-of-bounds Read in RIOT-OS RIOT

RIOT-OS versions before 2026.07 contain a vulnerability in the DHCPv6 client code, specifically in the _parse_reply() function located in sys/net/application_layer/dhcpv6/client.c. This function fails to validate the minimum length of IA_PD and IA_NA option bodies before passing them to sub-option parsers. When MODULE_DHCPV6_CLIENT_IA_PD is enabled, a malicious or compromised DHCPv6 server can send a REPLY message with an option length smaller than required. This triggers _parse_ia_pd_option to perform out-of-bounds heap reads due to size_t underflow, leading to potential device crashes and memory exposure or corruption. The vulnerability is tracked as CWE-125 (Out-of-bounds Read) and CWE-191 (Integer Underflow). The vendor fixed this issue in RIOT-OS version 2026.07.

Exploitation of this vulnerability allows a remote attacker controlling a DHCPv6 server to cause out-of-bounds heap reads on affected RIOT-OS devices. This can result in device crashes (denial of service) and may expose or corrupt memory contents, potentially compromising device integrity and confidentiality. The CVSS v3.1 score is 9.8 (critical), reflecting high impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

This vulnerability is fixed in RIOT-OS version 2026.07. Users and administrators should upgrade affected devices to version 2026.07 or later to remediate this issue. There is no indication that any other mitigation or workaround is available or required.