CVE-2025-66646
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving a fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL, but the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the gnrc_ipv6_ext_frag module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim.
Risk Assessment
An attacker can remotely crash the RIOT OS, causing denial of service (DoS) on IoT devices. The risk is high in environments where devices are exposed to IPv6 traffic from untrusted sources.
Recommendation
Update RIOT OS to version v2025.10, which fixes this vulnerability. If updating is not possible, consider disabling the gnrc_ipv6_ext_frag module or filtering IPv6 traffic.
Other vulnerabilities in RIOT OS
See all- CVE-2026-22214Critical
Stack-based buffer overflow in the ethos utility of RIOT OS up to version 2026.01-devel-317. Missing bounds checking in _handle_char() allows writing past the stack buffer when processing serial frames.
- CVE-2026-22213Critical
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input.
- CVE-2025-66647Critical
In RIOT OS v2025.07, a vulnerability was discovered in the IPv6 fragmentation reassembly implementation. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to use to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.
Original NVD description (English source)
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS