{"id":"CVE-2026-107837","published":"2026-10-09T18:17:05.483","lastModified":"2026-10-13T21:17:32.813","description":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/pull/22504","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m8mc-q4p7-p8j3","tags":[]}],"exploitRefs":[{"url":"https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/pull/22504","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m8mc-q4p7-p8j3","tags":[]}],"hasPoc":true,"ai":{"summary":"A buffer over-read vulnerability in RIOT OS allows remote attackers to read beyond packet buffers during 6LoWPAN fragment processing, potentially leading to memory disclosure and network stack crashes. This affects IoT devices running vulnerable versions of the operating system.","exploitability":"Exploitation is relatively straightforward for remote attackers who can send malformed 6LoWPAN fragments, requiring minimal preconditions beyond network access to the affected device.","blast_radius":"The vulnerability impacts a wide range of IoT and embedded devices using RIOT OS 2026.07 or earlier, potentially causing widespread network instability and information disclosure across connected systems.","remediation":"No fixed repository release is available as of this review; defenders should disable 6LoWPAN fragment processing or implement network-level restrictions to prevent malformed fragments from reaching affected devices until a fix is published.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["iot","embedded","network"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:56:54.266Z"}}