An out-of-bounds write bug exists in RIOT‑OS 2026.01 and earlier within the default coap_well_known_core handler. The handler directs user-supplied CoAP option data into a fixed-size buffer without validating that the buffer can hold the response. This flaw can corrupt adjacent stack memory, including sensitive addresses such as the return pointer, enabling an attacker to trigger denial of service or execute arbitrary code on the device. The weakness is classified as CWE‑787 Consumer Input Validation failure leading to out-of-bounds write.

Affected products include the RIOT‑OS operating system released up to and including version 2026.01. No other versions or products are listed as impacted, and the vulnerability is specific to the nanoCoAP handler within RIOT‑OS.

With a CVSS score of 7.5 the vulnerability is considered high severity. EPSS indicates an exploitation probability of less than 1%, and it is not listed in the CISA KEV catalogue, suggesting no publicly known exploits. The likely attack vector requires an attacker that can send crafted CoAP requests to the device; the vulnerability relies on leaking data through the CoAP protocol on a network where the device is reachable. While exploitation may demand some effort to correctly format the oversized option data, the absence of additional authentication or input checks lowers the barrier for an attacker with network access to the target.