Buffer Overflow Vulnerability in RIOT Operating System for IoT Devices

CVE-2026-49868

What is CVE-2026-49868?

The RIOT Operating System, utilized in Internet of Things devices, is susceptible to a buffer overflow vulnerability due to inadequate length validation in the _parse_reply() function. This flaw allows a malicious DHCPv6 server to send a malformed REPLY, leading to potential memory corruption and device crashes. Specifically, if the MODULE_DHCPV6_CLIENT_IA_PD is enabled, the vulnerability allows for out-of-bounds heap reads, which could result in the exposure of sensitive data or a crash of the affected device. This issue has been resolved in version 2026.07.

References