Buffer Overflow in RIOT-OS Internet of Things Operating System

CVE-2025-53888

What is CVE-2025-53888?

The RIOT-OS operating system for IoT devices has a vulnerability stemming from an ineffective size check implemented with assert(), leading to a potential buffer overflow. In the l2filter_add() function, the length of an address (addr_len) is only validated using an assertion. When assertions are disabled in production settings, this check is bypassed, allowing attackers to exploit input limitations. If an attacker provides an addr_len larger than CONFIG_L2FILTER_ADDR_MAXLEN, they could trigger a buffer overflow that may lead to a denial of service or arbitrary code execution. A patch addressing this vulnerability has been released.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References