{"id":"CVE-2026-107836","published":"2026-10-09T18:17:05.310","lastModified":"2026-10-09T18:17:05.310","description":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-125","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/pull/22518","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-x924-p5fq-26pc","tags":[]}],"exploitRefs":[{"url":"https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/pull/22518","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-x924-p5fq-26pc","tags":[]}],"hasPoc":true,"ai":null}