CVE-2026-102693

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads.

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(), and a remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption.

A stack-based buffer overflow in the ipv6_addr_from_str function in RIOT prior to April 25, 2017, can be exploited by local and potentially remote attackers. Attackers may cause a denial of service or possibly have unspecified other impacts via a malformed IPv6 address.

RIOT from version 2023.07 through 2026.07 ignores a failure returned by _resp_init() in nanocoap_fileserver when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a large extended token, causing response initialization to fail and leading to an assertion that terminates the service or task.

RIOT in 2026.07 and earlier, the _receive() function in gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. A remote attacker can send a malformed 6LoWPAN fragment causing read beyond the packet buffer, potentially disclosing memory and crashing the network stack.

RIOT in 2026.07 and earlier, the nanocoap_sock_get_slice() function accepts a Block2 response when _block_cb() sees the expected block number without verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing offset underflow and read before the payload buffer, potentially crashing the client.