Vulnerability in RIOT Microcontroller OS for IoT Devices

CVE-2026-107837

What is CVE-2026-107837?

The RIOT operating system, utilized in Internet of Things (IoT) devices, contains a vulnerability in its packet handling logic. Specifically, the function _receive() in gnrc_sixlowpan.c is susceptible to processing undersized packets due to inadequate payload validation. This flaw allows an attacker to send a malformed 6LoWPAN fragment, leading to out-of-bounds memory reads when gnrc_sixlowpan_frag_recv() interprets the incoming data incorrectly. Should such an attack occur, it could potentially disclose sensitive memory information and destabilize the network stack, compromising the device's functionality.

References