CVE-2026-107837
HighCVSS 8.2Summary
RIOT in 2026.07 and earlier, the _receive() function in gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. A remote attacker can send a malformed 6LoWPAN fragment causing read beyond the packet buffer, potentially disclosing memory and crashing the network stack.
Risk Assessment
The attack can lead to memory disclosure and network stack crash, potentially disrupting device operation.
Recommendation
No fixed repository release is available; monitor the repository and apply the patch when available.
Other vulnerabilities in RIOT
See all- CVE-2026-107838High
RIOT from version 2023.07 through 2026.07 ignores a failure returned by _resp_init() in nanocoap_fileserver when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a large extended token, causing response initialization to fail and leading to an assertion that terminates the service or task.
- CVE-2026-107836High
RIOT in 2026.07 and earlier, the nanocoap_sock_get_slice() function accepts a Block2 response when _block_cb() sees the expected block number without verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing offset underflow and read before the payload buffer, potentially crashing the client.
- CVE-2017-8289Critical
A stack-based buffer overflow in the ipv6_addr_from_str function in RIOT prior to April 25, 2017, can be exploited by local and potentially remote attackers. Attackers may cause a denial of service or possibly have unspecified other impacts via a malformed IPv6 address.
Original NVD description (English source)
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS