{"id":"CVE-2026-49868","published":"2026-10-16T17:17:34.963","lastModified":"2026-10-16T20:04:29.760","description":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-125","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/pull/22322","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/releases/tag/2026.07","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf","tags":[]}],"exploitRefs":[{"url":"https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/pull/22322","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/releases/tag/2026.07","tags":[]},{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf","tags":[]}],"hasPoc":true,"ai":{"summary":"A buffer over-read vulnerability in RIOT OS DHCPv6 client allows remote attackers to crash devices and potentially expose/corrupt memory by sending malformed DHCPv6 REPLY messages with truncated option lengths. This affects IoT devices running vulnerable versions of the OS.","exploitability":"Exploitation is relatively straightforward as it requires only a malicious DHCPv6 server to send specially crafted REPLY messages with truncated IA_PD options, no authentication required.","blast_radius":"The vulnerability could impact large numbers of IoT devices that rely on DHCPv6 for network configuration, potentially causing widespread service disruption and memory corruption across embedded systems.","remediation":"Upgrade to RIOT OS version 2026.07 or later to address the buffer over-read vulnerability in DHCPv6 client implementation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["iot","network","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:46:08.300Z"}}