CVE-2026-107837RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
Updated under an hour ago ()
Does this affect you?
It affects RIOT-OS RIOT. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.38%, higher than 30% of scored CVEs.
Do this next
Free account, 1 product
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.
- CVSS
- 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Weakness (CWE)
- CWE-125
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.38% (percentile 30)
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
RIOT-OS RIOT riot_os:riot (from the name) | through 2026.07 | CNA record |
References
- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m8mc-q4p7-p8j3x-refsource-confirm
- https://github.com/RIOT-OS/RIOT/pull/22504x-refsource-misc
- https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2dx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.