RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
Critical 9.1
CVE-2026-102692
RIOT-OS RIOT — denial of service.
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.
Published Updated Source NVD
CVSS 3.1
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploit chance, 30 days
0.4%
Higher than 28% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run RIOT-OS RIOT, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in RIOT-OS RIOT
2 more CVEs