Memory Corruption Vulnerability in RIOT's ATWINC15x0 Driver

CVE-2026-102693

What is CVE-2026-102693?

The ATWINC15x0 driver within RIOT, an open-source operating system tailored for IoT devices, contains a memory corruption vulnerability due to improper validation during SSID handling. Specifically, the _atwinc15x0_sta_set_current_ssid function utilizes strcpy without ensuring the destination buffer's capacity. When the MODULE_ATWINC15X0_DYNAMIC_CONNECT flag is activated, an attacker in proximity can present a malformed SSID, leading to potential memory corruption. This issue may result in a denial of service or unauthorized code execution. It has been resolved in the 2026.04 release.

References