# cve.now: Riot-os

The newest entries naming Riot-os as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-49868](https://cve.now/CVE-2026-49868.md): RIOT: DHCPv6 client \_parse\_reply() missing sub-option length check leads to size\_t underflow and unbounded OOB heap read (CVSS 9.8)
- [CVE-2026-102693](https://cve.now/CVE-2026-102693.md): RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID (CVSS 9.6)
- [CVE-2026-102692](https://cve.now/CVE-2026-102692.md): RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access (CVSS 9.1)
- [CVE-2026-107838](https://cve.now/CVE-2026-107838.md): RIOT: nanocoap\_fileserver ignores response initialization failure, leading to reachable assertion (CVSS 7.5)
- [CVE-2026-107837](https://cve.now/CVE-2026-107837.md): RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling (CVSS 8.2)
- [CVE-2026-107836](https://cve.now/CVE-2026-107836.md): RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size (CVSS 7.1)
- [CVE-2026-27703](https://cve.now/CVE-2026-27703.md): RIOT has an Out-of-Bounds Write in nanoCoAP Handler (CVSS 7.5)
- [CVE-2026-25139](https://cve.now/CVE-2026-25139.md): RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments (CVSS 8.7)
- [CVE-2025-66647](https://cve.now/CVE-2025-66647.md): RIOT OS has buffer overflow in gnrc\_ipv6\_ext\_frag\_reass (CVSS 1.7)
- [CVE-2025-66646](https://cve.now/CVE-2025-66646.md): RIOT-OS has NULL pointer dereference in gnrc\_ipv6\_ext\_frag\_reass (CVSS 1.7)
- [CVE-2025-53888](https://cve.now/CVE-2025-53888.md): RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link\_layer/l2filter/l2filter.c (CVSS 6.6)
- [CVE-2024-53980](https://cve.now/CVE-2024-53980.md): Spoofed length byte traps CC2538 in endless loop (CVSS 6.9)
- [CVE-2024-52802](https://cve.now/CVE-2024-52802.md): RIOT-OS missing dhcpv6\_opt\_t minimum header length check (CVSS 7.5)
- [CVE-2024-32018](https://cve.now/CVE-2024-32018.md): Ineffective size check due to assert() and buffer overflow in RIOT (CVSS 8.8)
- [CVE-2024-32017](https://cve.now/CVE-2024-32017.md): Buffer overflows in RIOT (CVSS 9.8)
- [CVE-2024-31225](https://cve.now/CVE-2024-31225.md): Lack of size check and buffer overflow in RIOT (CVSS 8.4)
- [CVE-2023-33975](https://cve.now/CVE-2023-33975.md): RIOT-OS vulnerable to Out of Bounds Write in \_rbuf\_add (CVSS 9.8)
- [CVE-2023-33974](https://cve.now/CVE-2023-33974.md): RIOT-OS vulnerable to Race Condition in SFR Timeout (CVSS 7.5)
- [CVE-2023-33973](https://cve.now/CVE-2023-33973.md): RIOT-OS vulnerable to NULL pointer dereference during NHC encoding (CVSS 7.5)
- [CVE-2023-24826](https://cve.now/CVE-2023-24826.md): Usage of Uninitialized Timer during forwarding of Fragments with SFR (CVSS 5.9)
- [CVE-2023-24825](https://cve.now/CVE-2023-24825.md): RIOT-OS vulnerable to NULL pointer dereference in gnrc\_pktbuf\_mark (CVSS 7.5)
- [CVE-2023-24817](https://cve.now/CVE-2023-24817.md): RIOT-OS vulnerable to Out of Bounds write in routing with SRH (CVSS 7.5)
- [CVE-2023-24823](https://cve.now/CVE-2023-24823.md): RIOT-OS vulnerable to Packet Type Confusion during IPHC send (CVSS 9.8)
- [CVE-2023-24822](https://cve.now/CVE-2023-24822.md): RIOT-OS vulnerable to Null Pointer dereference during IPHC encoding (CVSS 7.5)
- [CVE-2023-24821](https://cve.now/CVE-2023-24821.md): RIOT-OS vulnerable to Integer Underflow during defragmentation (CVSS 7.5)
- [CVE-2023-24820](https://cve.now/CVE-2023-24820.md): RIOT-OS vulnerable to Integer Underflow during IPHC receive (CVSS 7.5)
- [CVE-2023-24819](https://cve.now/CVE-2023-24819.md): RIOT-OS vulnerable to Buffer Overflow during IPHC receive (CVSS 9.8)
- [CVE-2023-24818](https://cve.now/CVE-2023-24818.md): RIOT-OS vulnerable to null pointer dereference during fragment forwarding (CVSS 7.5)
- [CVE-2021-27427](https://cve.now/CVE-2021-27427.md): RIOT OS Integer Overflow or Wraparound (CVSS 7.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/riot-os
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.