Out-of-Bounds Memory Access Vulnerability in RIOT Open-Source Operating System

CVE-2026-102692

What is CVE-2026-102692?

In RIOT, a widely-used open-source microcontroller operating system, prior versions before 2026.07 exhibit a vulnerability in the nanocoap module. This issue arises when the system accepts oversized CoAP Block2 option values without enforcing a critical 20-bit maximum block number. As a result, the block offset can overflow, leading to a situation where a remote CoAP client may exploit this flaw by sending a malformed Block2 option. This exploit can generate an invalid slice range, resulting in out-of-bounds memory access, potential denial of service, or memory corruption. Users are advised to upgrade to version 2026.07, where this vulnerability is patched.

References