CVE-2026-49868 Details

A critical vulnerability exists in the RIOT operating system's DHCPv6 client implementation, specifically in the option parsing function '_parse_reply()' within 'sys/net/application_layer/dhcpv6/client.c'. Prior to version 2026.07, this function fails to validate the minimum length of IA_PD and IA_NA option bodies before processing them. As a result, a malicious DHCPv6 server can send a reply with an option length that is too short, causing the parser to read beyond the intended buffer. This oversight leads to a size underflow and unbounded out-of-bounds heap reads, which can crash the device and potentially expose or corrupt memory. The vulnerability is particularly severe on bare-metal Cortex-M targets without a memory management unit, where it can cause a hard fault, crashing the device.

Users can upgrade to RIOT version 2026.07 or later, where this vulnerability has been fixed.