Out-of-Bounds Read Vulnerability in RIOT Operating System by RIOT

CVE-2026-25139

What is CVE-2026-25139?

The RIOT Operating System, which caters to Internet of Things (IoT) and embedded devices, is susceptible to out-of-bounds read vulnerabilities. Specifically, unauthenticated users can exploit this flaw by sending or manipulating input packets that allow them to read adjacent memory areas or potentially crash devices running the 6LoWPAN stack. The exploitation occurs when a packet is cast into a 'sixlowpan_sfr_rfrag_t' struct without proper validation of its size, leading to dereferencing errors. As of now, there are no patches available to mitigate this vulnerability.

References