CVE-2026-49868 is a critical out-of-bounds read vulnerability in RIOT-OS affecting versions prior to 2026.07. The flaw occurs in the DHCPv6 client implementation where minimum-length validation is missing before parsing IA_PD and IA_NA option bodies. A malicious DHCPv6 server can exploit this by sending a reply with an option length smaller than expected, leading to heap memory reads beyond the option boundary. This can cause device crashes and potential memory exposure or corruption. The issue is fixed in version 2026.07.
CVE-2026-102693 is a critical buffer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.04. The flaw exists in the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function, which uses strcpy to copy an SSID without validating the destination buffer size. When the MODULE_ATWINC15X0_DYNAMIC_CONNECT feature is enabled, an attacker within Wi-Fi range can send a malformed or oversized SSID during scanning, leading to memory corruption. This can cause a hard fault, denial of service, or potentially allow code execution. The vulnerability is fixed in RIOT-OS version 2026.04.
CVE-2026-102692 is a critical integer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.07. It arises from the nanocoap module accepting oversized CoAP Block2 option values without enforcing the 20-bit maximum block number limit. This allows block offset multiplication to overflow on 32-bit targets, leading to invalid slice ranges. A remote CoAP client can exploit this by sending a malformed Block2 option, potentially causing out-of-bounds memory access, denial of service, or memory corruption. The vulnerability is fixed in version 2026.07.
CVE-2026-107838 is a high-severity vulnerability in RIOT-OS affecting versions from 2023.07 through 2026.07. It involves unchecked return values in the nanocoap_fileserver component, where failure from _resp_init() is ignored, leading to assertion failures and termination of the affected service or device task when processing specially crafted CoAP requests with large extended tokens. No official fix is available as of the latest review.
CVE-2026-107837 is a high-severity out-of-bounds read vulnerability in RIOT-OS, an open-source microcontroller operating system for IoT devices. The flaw exists in the _receive() function of the sixlowpan network layer in versions 2026.07 and earlier. It allows a remote attacker to send a malformed 6LoWPAN fragment that triggers reading beyond the packet buffer, potentially causing memory disclosure and crashing the network stack. No official fix or patched release is available as of the latest review.
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.
CVE-2026-27703 is a high-severity out-of-bounds write vulnerability in RIOT-OS, an open-source operating system for IoT and embedded devices. The flaw exists in the default handler for the coap_well_known_core resource, which writes user-supplied option data into a fixed-size buffer without proper size validation. This can lead to corruption of adjacent stack memory, including critical control flow data such as return addresses. Exploitation can result in denial of service or arbitrary code execution without requiring authentication or user interaction. The vulnerability affects RIOT versions up to and including 2026.01. Although no known exploits are currently reported in the wild, the ease of remote exploitation and potential impact on device integrity make this a significant threat. Organizations deploying RIOT-OS in IoT environments should prioritize patching and implement strict input validation and memory safety practices to mitigate risk.
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.
CVE-2025-66647 is a buffer overflow vulnerability in the IPv6 fragmentation reassembly implementation of RIOT-OS versions prior to 2025.10. The flaw occurs because the system does not check the size when copying the first IPv6 fragment into the reassembly buffer, allowing an attacker to overflow this buffer by manipulating fragment sizes. This overflow can corrupt adjacent packet buffers, potentially enabling further memory corruption and remote code execution. Exploitation requires the vulnerable gnrc_ipv6_ext_frag module to be enabled and the ability to send arbitrary IPv6 packets to the target device. Although the CVSS score is low (1.7), the vulnerability could be critical in specific IoT contexts where RIOT-OS is deployed. The issue is fixed in version 2025.10, and no known exploits are currently reported in the wild.
CVE-2025-66646 is a low-severity vulnerability in RIOT OS versions prior to 2025.10, affecting the IPv6 fragmentation reassembly module. The flaw is a NULL pointer dereference triggered when a fragmented IPv6 packet with fragment offset 0 and an empty payload is received, causing the OS to crash and resulting in a denial of service (DoS). Exploitation requires the gnrc_ipv6_ext_frag module to be enabled and the attacker to send crafted IPv6 packets to the device. No authentication or user interaction is needed, but the impact is limited to DoS without data compromise. The vulnerability has a CVSS 4.0 score of 1.7, indicating low severity. European organizations using RIOT OS in IoT or embedded devices should update to version 2025.10 to mitigate this issue.
RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against untrusted inputs, the software may be exposed to attacks that utilize the lack of proper input checks. In the `l2filter_add()` function shown below, `addr_len` is checked using an assertion and is subsequently used as an argument in a `memcpy()` call. When assertions are disabled, there would be no size check for `addr_len`. As a consequence, if an attacker were to provide an `addr_len` value larger than `CONFIG_L2FILTER_ADDR_MAXLEN`, they can trigger a buffer overflow and write past the `list[i].addr` buffer. If the unchecked input is attacker-controlled, the impact of the buffer overflow can range from a denial of service to arbitrary code execution. Commit f6f7de4ccc107c018630e4c15500825caf02e1c2 contains a patch for the vulnerability.