The vulnerability arises when the RIOT 6LoWPAN stack processes received Frame Fragment SFR packets without size validation. Incoming data is cast directly to a sixlowpan_sfr_rfrag_t structure, creating an out‑of‑bounds read. An unauthenticated attacker can send crafted 6LoWPAN fragments to cause the operating system to read arbitrary adjacent memory or to crash the device. The read may expose sensitive information stored in nearby memory, while a crash would result in denial of service.

The flaw affects the RIOT open‑source microcontroller OS, specifically versions 2025.10 and earlier. All devices running the 6LoWPAN stack in those releases are vulnerable. At release time no patch was available from RIOT‑OS; users should verify the firmware version against the advisory.

The CVSS score of 8.7 indicates a high severity, and the EPSS score of less than 1% suggests a low probability of exploitation observed so far. The vulnerability is not listed in CISA’s KEV catalog, but a remote attacker with network access can exploit it by sending malformed SFR fragments over 6LoWPAN. Because the code bypasses bounds checking, the attack requires only network connectivity and no authentication, giving the attacker broad potential impact.