Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
Published: 2026-10-16
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption via out‑of‑bounds heap read
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises when the DHCPv6 client parses a reply packet and does not validate the minimum length of certain options before delegating to sub‑parsers. This omission allows a malformed option body to trigger a size_t underflow, which then leads to an unbounded out‑of‑bounds heap read. The read can crash the device or expose, corrupt, or overwrite memory, potentially degrading device availability or introducing memory integrity issues.

Affected Systems

All RIOT‑OS releases prior to version 2026.07 that include the DHCPv6 client with MODULE_DHCPV6_CLIENT_IA_PD enabled are vulnerable. This includes devices running SI extensions for IPv6 address assignment from a DHCPv6 server. The issue targets the file sys/net/application_layer/dhcpv6/client.c within the RIOT codebase.

Risk and Exploitability

The CVSS score of 9.8 flags this flaw as critical. Though the EPSS score is not available, the absence from the KEV list does not lower its potential impact. An attacker can trigger the flaw by acting as a malicious or compromised DHCPv6 server, sending a carefully crafted REPLY packet that exploits the lack of length checking. Successful exploitation can cause a device crash or corrupt memory, which could lead to denial of service or other unintended behaviors.

Generated by OpenCVE AI on October 16, 2026 at 19:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to RIOT release 2026.07 or later, where the issue is fixed.
  • If the DHCPv6 client functionality is not required, disable MODULE_DHCPV6_CLIENT_IA_PD in the build configuration to remove the vulnerable code path.
  • Implement network controls to limit DHCPv6 traffic from untrusted sources, such as restricting the DHCPv6 server address or applying firewall rules, to reduce the attack surface.

Generated by OpenCVE AI on October 16, 2026 at 19:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Riot-os
Riot-os riot
Vendors & Products Riot-os
Riot-os riot

Wed, 21 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
Title RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
Weaknesses CWE-125
CWE-191
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Riot-os Riot
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-21T02:29:33.220Z

Reserved: 2026-06-01T22:03:19.641Z

Link: CVE-2026-49868

cve-icon Vulnrichment

Updated: 2026-10-21T02:29:28.123Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T17:17:34.963

Modified: 2026-10-21T03:17:19.597

Link: CVE-2026-49868

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T10:45:16Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-191

    Integer Underflow (Wrap or Wraparound)