Threat Intelligence Database

CVE-2026-27703 is a high-severity out-of-bounds write vulnerability in RIOT-OS, an open-source operating system for IoT and embedded devices. The flaw exists in the default handler for the coap_well_known_core resource, which writes user-supplied option data into a fixed-size buffer without proper size validation. This can lead to corruption of adjacent stack memory, including critical control flow data such as return addresses. Exploitation can result in denial of service or arbitrary code execution without requiring authentication or user interaction. The vulnerability affects RIOT versions up to and including 2026.01. Although no known exploits are currently reported in the wild, the ease of remote exploitation and potential impact on device integrity make this a significant threat. Organizations deploying RIOT-OS in IoT environments should prioritize patching and implement strict input validation and memory safety practices to mitigate risk.

HighVulnerabilityUnited StatesGermanyChina+7#cve#cve-2026-27703#cwe-787

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2026-25139#cwe-125

CVE-2025-66647 is a buffer overflow vulnerability in the IPv6 fragmentation reassembly implementation of RIOT-OS versions prior to 2025.10. The flaw occurs because the system does not check the size when copying the first IPv6 fragment into the reassembly buffer, allowing an attacker to overflow this buffer by manipulating fragment sizes. This overflow can corrupt adjacent packet buffers, potentially enabling further memory corruption and remote code execution. Exploitation requires the vulnerable gnrc_ipv6_ext_frag module to be enabled and the ability to send arbitrary IPv6 packets to the target device. Although the CVSS score is low (1.7), the vulnerability could be critical in specific IoT contexts where RIOT-OS is deployed. The issue is fixed in version 2025.10, and no known exploits are currently reported in the wild.

LowVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-66647#cwe-120

CVE-2025-66646 is a low-severity vulnerability in RIOT OS versions prior to 2025.10, affecting the IPv6 fragmentation reassembly module. The flaw is a NULL pointer dereference triggered when a fragmented IPv6 packet with fragment offset 0 and an empty payload is received, causing the OS to crash and resulting in a denial of service (DoS). Exploitation requires the gnrc_ipv6_ext_frag module to be enabled and the attacker to send crafted IPv6 packets to the device. No authentication or user interaction is needed, but the impact is limited to DoS without data compromise. The vulnerability has a CVSS 4.0 score of 1.7, indicating low severity. European organizations using RIOT OS in IoT or embedded devices should update to version 2025.10 to mitigate this issue.

LowVulnerabilityGermanyFranceNetherlands+2#cve#cve-2025-66646#cwe-476

RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against untrusted inputs, the software may be exposed to attacks that utilize the lack of proper input checks. In the `l2filter_add()` function shown below, `addr_len` is checked using an assertion and is subsequently used as an argument in a `memcpy()` call. When assertions are disabled, there would be no size check for `addr_len`. As a consequence, if an attacker were to provide an `addr_len` value larger than `CONFIG_L2FILTER_ADDR_MAXLEN`, they can trigger a buffer overflow and write past the `list[i].addr` buffer. If the unchecked input is attacker-controlled, the impact of the buffer overflow can range from a denial of service to arbitrary code execution. Commit f6f7de4ccc107c018630e4c15500825caf02e1c2 contains a patch for the vulnerability.

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-53888#cwe-120