CVE-2026-102692 Details
Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
A vulnerability in the RIOT operating system's nanocoap implementation allows for integer overflow when processing oversized CoAP Block2 option values. This issue, present in versions through 2026.07, can lead to out-of-bounds memory access, causing denial-of-service conditions or memory corruption. The vulnerability arises because the Block2 option values are not properly validated, allowing malformed options to create invalid slice ranges that disrupt normal processing.
Users can update to RIOT OS version 2026.07, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RIOT-OS/RIOT/commit/6b283ace3565d931b3edff7e115d4f79339253b8 | [email protected] | Source CodeVendor |
| https://github.com/RIOT-OS/RIOT/commit/ee1fa0ef91874494823d476392572aeefdbc6b74 | [email protected] | Source CodeVendor |
| https://github.com/RIOT-OS/RIOT/releases/tag/2026.07 | [email protected] | Release NotesVendor |
| https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8365-gj33-rgpf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RIOT | <= master (commit aeeae69e) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |