Riot-os vulnerabilities
29 CVEs and advisories name Riot-os as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-49868RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
- CVE-2026-102693RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
- CVE-2026-102692RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
- CVE-2026-107838RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion
- CVE-2026-107837RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
- CVE-2026-107836RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size
- CVE-2026-27703RIOT has an Out-of-Bounds Write in nanoCoAP Handler
- CVE-2026-25139RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments
- CVE-2025-66647RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
- CVE-2025-66646RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
- CVE-2025-53888RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c
- CVE-2024-53980Spoofed length byte traps CC2538 in endless loop
- CVE-2024-52802RIOT-OS missing dhcpv6_opt_t minimum header length check
- CVE-2024-32018Ineffective size check due to assert() and buffer overflow in RIOT
- CVE-2024-32017Buffer overflows in RIOT
- CVE-2024-31225Lack of size check and buffer overflow in RIOT
- CVE-2023-33975RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add
- CVE-2023-33974RIOT-OS vulnerable to Race Condition in SFR Timeout
- CVE-2023-33973RIOT-OS vulnerable to NULL pointer dereference during NHC encoding
- CVE-2023-24826Usage of Uninitialized Timer during forwarding of Fragments with SFR
- CVE-2023-24825RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark
- CVE-2023-24817RIOT-OS vulnerable to Out of Bounds write in routing with SRH
- CVE-2023-24823RIOT-OS vulnerable to Packet Type Confusion during IPHC send
- CVE-2023-24822RIOT-OS vulnerable to Null Pointer dereference during IPHC encoding
- CVE-2023-24821RIOT-OS vulnerable to Integer Underflow during defragmentation
- CVE-2023-24820RIOT-OS vulnerable to Integer Underflow during IPHC receive
- CVE-2023-24819RIOT-OS vulnerable to Buffer Overflow during IPHC receive
- CVE-2023-24818RIOT-OS vulnerable to null pointer dereference during fragment forwarding
- CVE-2021-27427RIOT OS Integer Overflow or Wraparound