RIOT is an open‑source microcontroller operating system. A flaw in the nanoCoAP client function nanocoap_sock_get_slice() allows a malicious CoAP server to send a Block2 response containing a larger block size than requested. Because the client does not verify that the server‑controlled szx and derived offset match the expected block geometry, a buffer‑relative calculation can under‑flow. This under‑flow causes the client to read memory before the payload buffer, leading to a crash. The crash results in a denial of service and, due to the under‑read, could potentially expose data located adjacent to the buffer. The weakness is identified by CWE-125 and CWE-191.

The vulnerability affects all RIOT‑OS releases 2026.07 and earlier where the nanoCoAP client is compiled without the patch. Any IoT device or embedded system running these versions and communicating with a CoAP server that supports Block2 requests is potentially exposed. The specific component impacted is the function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the issue has not been listed in the CISA KEV catalog yet, suggesting limited current exploitation activity. However, a malicious CoAP server can trivially manipulate the block size field, and the vulnerability does not require local privileges. Based on the description, it is inferred that the attacker only needs network access to the target’s CoAP client. The resulting denial of service could impact device availability, and the memory read could aid in information disclosure depending on the system’s memory layout.