The RIOT‑OS nanocoap stack incorrectly allows oversized CoAP Block2 options to exceed the 20‑bit maximum block number. The unchecked block offset multiplication on 32‑bit targets can overflow, producing an invalid slice range. A remote CoAP client can supply a malformed Block2 option that leads to out‑of‑bounds reads or writes in memory. This memory corruption can crash the device or cause denial of service. The description does not confirm any code execution path, limiting the impact to memory corruption and service disruption.

The flaw exists in the RIOT‑OS master code before the 2026.07 release and is fixed in that release. All deployments that incorporate the vulnerable master baseline before 2026.07, particularly embedded devices running the nanocoap stack on 32‑bit architectures, are affected. The vulnerable code is identified by commit aeeae69e; any firmware built from that commit or later without the 2026.07 fix remains vulnerable.

With a CVSS score of 9.1 the vulnerability is high severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The flaw is remotely exploitable via CoAP; an attacker needs only network connectivity to the target device and the ability to send a crafted Block2 packet. The vulnerability is not listed in CISA KEV, but the high CVSS score and potential for memory corruption warrant immediate action.