CVE-2026-107836 Details

A buffer underflow vulnerability has been identified in the RIOT operating system's nanoCoAP client, specifically in versions through 2026.07. The issue arises in the function 'nanocoap_sock_get_slice()', which improperly handles Block2 responses from CoAP servers. When a server returns the expected block number but with a larger block size, the derived offset can exceed the client's slice offset. This discrepancy causes a subtraction underflow, leading to an out-of-bounds read before the payload buffer, crashing the client and creating a denial-of-service condition. Additionally, this vulnerability could potentially expose adjacent memory.

As of now, no fixed release is available. However, the vulnerability can be addressed by validating that the Block2 'szx' and derived offset from the server are consistent with the client's expectations before processing the response. Additionally, the '_2buf_slice()' function should be hardened against subtraction underflows.