Vulnerability details
CVE-2026-102692
RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
Official description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| RIOT-OS | RIOT | < 2026.07 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8365-gj33-rgpf x_refsource_CONFIRM
- https://github.com/RIOT-OS/RIOT/commit/6b283ace3565d931b3edff7e115d4f79339253b8 x_refsource_MISC
- https://github.com/RIOT-OS/RIOT/commit/ee1fa0ef91874494823d476392572aeefdbc6b74 x_refsource_MISC
- https://github.com/RIOT-OS/RIOT/releases/tag/2026.07 x_refsource_MISC
Details
- Published
- 2026-10-16
- Last updated
- 2026-10-17
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 21 · Low
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-190Integer Overflow or Wraparound
- CWE-787Out-of-bounds Write